The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a helper Python script using the subprocess.run function. The implementation correctly passes arguments as a list rather than a single shell string, which effectively prevents command injection vulnerabilities. The use of the Bash tool is appropriate for the skill's local workflow orchestration.
[CREDENTIALS_UNSAFE]: The skill requires an OpenRouter API key to function. It implements secure credential management by sourcing the key from environment variables or a .env file rather than hardcoding sensitive tokens. Instructions to store secrets in .env files follow standard industry practices for local development environments.
[PROMPT_INJECTION]: The skill accepts natural language descriptions from users that are incorporated into AI prompts for diagram generation. While this represents a surface for indirect prompt injection, the risk is mitigated as the skill's output is restricted to image files and structured JSON logs, and it includes an automated quality review step using a secondary AI model to verify the scientific accuracy and clarity of the output.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to the OpenRouter API (openrouter.ai) to interact with AI models. OpenRouter is a well-known service in the AI ecosystem, and these requests are necessary for the skill's primary purpose. The skill also recommends installing standard packages like requests via the uv package manager.

scientific-schematics