hypothesis-generation

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run local scripts and compile documents. It executes Python scripts (scripts/generate_schematic.py) for diagram generation and standard LaTeX tools (xelatex, bibtex) for report creation. These operations are essential to its documented functionality and are implemented using secure subprocess management practices.
  • [EXTERNAL_DOWNLOADS]: The schematic generation feature communicates with the OpenRouter API (openrouter.ai) to generate and critique scientific diagrams. OpenRouter is a well-known service for LLM aggregation, and its use is consistent with the skill's primary purpose of AI-assisted scientific writing.
  • [DATA_EXPOSURE]: The skill handles an API key (OPENROUTER_API_KEY) for its image generation features. The implementation follows security best practices by loading the key from environment variables or .env files and passing it to subprocesses via the environment rather than command-line arguments, preventing exposure in process listings.
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting data from external scientific sources such as PubMed. This represents a standard surface for indirect prompt injection common to information-retrieval tasks, which is mitigated by the structured synthesis process described in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 06:23 AM