infographics

Pass

Audited by Gen Agent Trust Hub on Apr 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate_infographic.py acts as a wrapper that executes a secondary Python script (generate_infographic_ai.py) using subprocess.run(). While this follows the standard pattern for modularizing logic, it involves the execution of local shell commands.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to openrouter.ai and perplexity.ai to interface with language and image generation models. These are well-known technology services required for the skill's primary function of infographic generation and research.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. In scripts/generate_infographic_ai.py, the _enhance_prompt_with_research method interpolates external data fetched via the Perplexity API directly into the generation prompt.
  • Ingestion points: External data enters the context from the research_topic function in scripts/generate_infographic_ai.py via the Perplexity Sonar Pro model.
  • Boundary markers: The skill uses simple text headers such as "RESEARCHED DATA AND FACTS" but lacks robust escaping or "ignore previous instructions" delimiters to isolate untrusted data.
  • Capability inventory: The skill has capabilities to write files to the local system (images and logs), execute subprocesses (via the wrapper script), and perform network operations.
  • Sanitization: There is no evidence of sanitization or validation of the content returned from the external research API before it is passed to the next stage of the AI pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 12, 2026, 08:27 AM