latex-posters

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate_schematic.py uses subprocess.run() to execute a secondary Python script for AI image generation. The command is constructed as a list of arguments without using a shell environment, which is a secure practice that prevents shell injection attacks.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the openrouter.ai API via the requests library in scripts/generate_schematic_ai.py. This network activity is used to generate scientific schematics and perform quality reviews of images using Google Gemini models. OpenRouter is a well-known and established service.
  • [CREDENTIALS_UNSAFE]: The AI generation scripts utilize an OPENROUTER_API_KEY. The implementation correctly searches for this key in environment variables and .env files, avoiding hardcoded secrets within the skill's source code.
  • [DATA_EXFILTRATION]: User-provided text prompts and generated image data are transmitted to the OpenRouter API. This data transmission is the primary intended function of the schematic generation feature and does not involve sensitive local file access or unauthorized data harvesting.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 10:49 PM