scholar-evaluation
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/generate_schematic.pyusessubprocess.runto call a secondary Python script. The command is constructed as a list, which is a secure practice that prevents shell injection. This execution is used to modularize the AI generation logic. - [EXTERNAL_DOWNLOADS]: The
scripts/generate_schematic_ai.pyscript communicates with the OpenRouter API (openrouter.ai) to generate images and perform quality reviews using Google Gemini models. This is an expected and functional behavior for a schematic generation tool. - [CREDENTIALS_UNSAFE]: The skill utilizes an
OPENROUTER_API_KEYfor its AI features. It correctly manages this sensitive information by retrieving it from environment variables or a local.envfile rather than hardcoding it in the script, adhering to standard security best practices for secret management.
Audit Metadata