scientific-schematics

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The wrapper script scripts/generate_schematic.py uses subprocess.run to execute the secondary logic script scripts/generate_schematic_ai.py. This is an internal execution pattern used to separate the CLI interface from the API logic and does not expose the system to arbitrary shell injection from untrusted sources.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests using the requests library to openrouter.ai. These requests are necessary to transmit diagram descriptions to the image generation model and receive the resulting binary image data. OpenRouter is a well-known service for AI model access, and the skill includes appropriate timeouts and error handling for these operations.
  • [CREDENTIALS_UNSAFE]: The skill correctly handles the OpenRouter API key by requiring it to be provided via environment variables (OPENROUTER_API_KEY) or a local .env file. It avoids hardcoding secrets and provides clear documentation on secure setup practices for users.
  • [DATA_EXPOSURE]: The skill writes generated image data and review logs to user-specified paths within the project directory (e.g., the figures/ folder). It does not attempt to access or exfiltrate sensitive system files such as SSH keys or cloud credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 07:58 PM