hypothesis-generation
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to run local scripts and compile documents. It executes Python scripts (scripts/generate_schematic.py) for diagram generation and standard LaTeX tools (xelatex,bibtex) for report creation. These operations are essential to its documented functionality and are implemented using secure subprocess management practices. - [EXTERNAL_DOWNLOADS]: The schematic generation feature communicates with the OpenRouter API (
openrouter.ai) to generate and critique scientific diagrams. OpenRouter is a well-known service for LLM aggregation, and its use is consistent with the skill's primary purpose of AI-assisted scientific writing. - [DATA_EXPOSURE]: The skill handles an API key (
OPENROUTER_API_KEY) for its image generation features. The implementation follows security best practices by loading the key from environment variables or.envfiles and passing it to subprocesses via the environment rather than command-line arguments, preventing exposure in process listings. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting data from external scientific sources such as PubMed. This represents a standard surface for indirect prompt injection common to information-retrieval tasks, which is mitigated by the structured synthesis process described in the instructions.
Audit Metadata