scientific-schematics
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto call a helper script for AI image generation. It securely implements this by passing arguments as a list rather than a shell string, which effectively prevents command injection attacks. - [EXTERNAL_DOWNLOADS]: The skill interacts with the OpenRouter API (
openrouter.ai) to access LLM models. This is a well-known service necessary for the skill's primary functionality and is handled via standard HTTP requests. - [CREDENTIALS_UNSAFE]: The code and documentation encourage the use of environment variables and
.envfiles for managing theOPENROUTER_API_KEY. This is a best-practice approach for credential management and prevents secrets from being hardcoded or exposed in command history.
Audit Metadata