The Agent Skills Directory

[COMMAND_EXECUTION]: The wrapper script scripts/generate_schematic.py utilizes subprocess.run() to execute the internal generate_schematic_ai.py component. This execution is performed securely using a list of arguments with the default shell=False setting, effectively preventing shell injection vulnerabilities. The script also validates critical inputs, such as the maximum iteration count and the output file extension, prior to execution.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to the OpenRouter API (openrouter.ai) to facilitate image generation and quality reviews using Gemini models. These operations are the primary intended function of the skill and utilize a well-known technology service. The communication is authenticated via standard Bearer tokens.
[CREDENTIALS_UNSAFE]: The skill manages the OPENROUTER_API_KEY by resolving it from environment variables or local .env files, which is a standard and secure practice for secret management. It avoids hardcoding credentials and passes the resolved key to child processes through the environment rather than command-line arguments, preventing the key from appearing in process listings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided natural language descriptions to generate diagrams. While this creates a surface for prompt injection, the impact is confined to the quality of the generated image.
Ingestion points: User-provided prompt passed via the command line to scripts/generate_schematic.py.
Boundary markers: The prompt is encapsulated within a structured JSON payload sent to the LLM.
Capability inventory: Network access via requests and internal script execution via subprocess.
Sanitization: Validation of numeric arguments and file paths is present in the wrapper script.

scientific-schematics