scientific-figure

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run to interface with the Inkscape binary for high-fidelity PDF and PNG exports. The implementation uses a list of arguments and shell execution is disabled, adhering to secure practices for calling external utilities.
  • [EXTERNAL_DOWNLOADS]: The skill uses the uv package manager to dynamically load reputable scientific libraries such as svgutils, lxml, cairosvg, and matplotlib. These dependencies are standard for scientific plotting and are sourced from official package registries.
  • [SAFE]: Extensive analysis across all threat categories reveals no indicators of prompt injection, data exfiltration, or obfuscation. The codebase follows standard conventions for scientific software development and uses local file operations strictly for figure composition.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 05:16 AM
Security Audit — agent-trust-hub — scientific-figure