scientific-schematics
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The wrapper script
scripts/generate_schematic.pyusessubprocess.runto execute the secondary logic scriptscripts/generate_schematic_ai.py. This is an internal execution pattern used to separate the CLI interface from the API logic and does not expose the system to arbitrary shell injection from untrusted sources. - [EXTERNAL_DOWNLOADS]: The skill performs network requests using the
requestslibrary toopenrouter.ai. These requests are necessary to transmit diagram descriptions to the image generation model and receive the resulting binary image data. OpenRouter is a well-known service for AI model access, and the skill includes appropriate timeouts and error handling for these operations. - [CREDENTIALS_UNSAFE]: The skill correctly handles the OpenRouter API key by requiring it to be provided via environment variables (
OPENROUTER_API_KEY) or a local.envfile. It avoids hardcoding secrets and provides clear documentation on secure setup practices for users. - [DATA_EXPOSURE]: The skill writes generated image data and review logs to user-specified paths within the project directory (e.g., the
figures/folder). It does not attempt to access or exfiltrate sensitive system files such as SSH keys or cloud credentials.
Audit Metadata