infographics
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The wrapper script
generate_infographic.pyusessubprocess.run()to execute the internal logic scriptgenerate_infographic_ai.py. The command is constructed using a list of arguments, which is a secure practice that prevents shell injection attacks. - [DATA_EXFILTRATION]: The skill communicates with the OpenRouter API (
openrouter.ai) to generate infographic images and perform quality reviews. This network activity is the primary function of the skill and is directed at a well-known service. The script securely manages API keys by retrieving them from environment variables or a local.envfile. - [PROMPT_INJECTION]: The skill ingests user-provided text prompts and interpolates them into instructions for external AI models (Perplexity Sonar and Gemini). While it lacks strong boundary markers (e.g., XML tags or unique delimiters) around the user input, the logic is consistent with standard AI tool implementation and contains no malicious instructions or bypass attempts.
Audit Metadata