scientific-slides
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs
subprocess.runto execute internal Python scripts and thepdflatexbinary for presentation validation. Notably,validate_presentation.pyuses the-no-shell-escapeflag as a security best practice to prevent the LaTeX engine from executing arbitrary shell commands. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to the OpenRouter API (
openrouter.ai) to generate slide images and technical schematics. This is a well-known service for LLM-powered content generation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions and interpolates them into prompt templates for AI image generation. It uses structural headers like
USER REQUEST:as boundary markers. Capability inventory: The skill has the ability to write files to the working directory and execute local commands for validation purposes. No explicit sanitization of the user input was observed prior to interpolation.
Audit Metadata