infographics
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script "scripts/generate_infographic.py" uses "subprocess.run" to call its internal helper script "scripts/generate_infographic_ai.py". This is a standard architectural pattern for command-line tools to pass arguments and does not present a security risk in this context.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it interpolates user-supplied text directly into prompts sent to external AI models without using delimiters or sanitization. This could allow a crafted input to influence the AI's generation parameters or research process.
- Ingestion points: The "prompt" argument in "scripts/generate_infographic_ai.py" is used to build prompts for research and image generation.
- Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when inserting user input into the prompt templates in "_build_generation_prompt".
- Capability inventory: The skill uses the "requests" library to communicate with the OpenRouter API for image generation and research tasks.
- Sanitization: There is no evidence of input validation, escaping, or filtering for the user-provided infographic description.
Audit Metadata