Skills scientific-schematics
📦
scientific-schematics
Content revision r1 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands
Generate Publication-Ready Scientific Schematics
Scientific teams need clear diagrams without slow manual drawing. This skill turns detailed prompts into reviewed schematics, pathways, flowcharts, and architecture figures.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "scientific-schematics" from https://skillstore.io/skills/k-dense-ai-scientific-schematics.md and its manifest at https://skillstore.io/api/skills/k-dense-ai-scientific-schematics/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "scientific-schematics". A request for a CONSORT participant flow diagram with screened, excluded, randomized, and analyzed counts.
Expected outcome:
A labeled participant flowchart image, versioned iteration files, and a review log with score and critique.
Using "scientific-schematics". A request for a transformer encoder-decoder architecture with attention blocks and cross-attention links.
Expected outcome:
A structured neural network architecture diagram with labeled encoder, decoder, attention, normalization, and output stages.
Using "scientific-schematics". A request for a MAPK pathway from receptor activation to gene transcription.
Expected outcome:
A biological pathway schematic with directional arrows, kinase labels, phosphorylation annotations, and distinct component colors.
Security Audit
High Riskv7 • 7/5/2026 Open versioned report
Most Markdown shell-backtick, system-reconnaissance, and documentation URL findings are false positives. Confirmed risks are concentrated in intended OpenRouter network calls, broad .env loading, API-key handling patterns, and local output or log writes. No evidence found of prompt injection, malware intent, or hidden exfiltration beyond the configured external API workflow.
7
Files scanned
2,786
Lines analyzed
39
Review items
0
False positives ignored
Confirmed security concerns (13)
High
Environment file access
# Or add to .env file
The documentation recommends using a .env file for API credentials. That can be safe if managed carefully, but it is sensitive file handling.
High
Environment file access
echo "OPENROUTER_API_KEY=sk-or-v1-..." >> .env
The command writes an API key into .env. This creates a local secret file that may be accidentally committed or disclosed.
High
Environment file access
# Try to load .env file from multiple potential locations
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
"""Load .env file from current directory, parent directories, or package directory.
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
Returns True if a .env file was found and loaded, False otherwise.
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
env_path = Path.cwd() / ".env"
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
env_path = cwd / ".env"
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
env_path = script_dir / ".env"
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
Show all 13 confirmed findings
High
Environment file access
# Priority: 1) explicit api_key param, 2) environment variable, 3) .env file
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
# If not found in environment, try loading from .env file
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
Environment file access
" 2. Add OPENROUTER_API_KEY to your .env file\n"
The executable code intentionally searches for and loads .env files as an API-key fallback. The behavior is legitimate, but it handles sensitive environment files.
High
API Key Exposure Through Command Arguments
The wrapper forwards the API key as a command-line argument to a child process, and the CLI supports direct key arguments. Command-line secrets can appear in process listings, shell history, and audit logs.
The subprocess wrapper directly adds the API key to argv, and documentation shows the same CLI pattern. The exposure risk is local but concrete.
Medium
Persistent Logs May Store Sensitive Research Prompts
The generator saves full prompts, critiques, image paths, and scores into review logs. Users may include unpublished research details or proprietary system information in diagram prompts.
The logged result object includes prompt and critique fields and is written to disk. This is intended functionality, but it creates a durable local disclosure surface.
Capability review items (39)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
echo 'export OPENROUTER_API_KEY="sk-or-v1-your_key"' >> ~/.bashrc # or ~/.zshrc
The documentation tells users to append an API key export to a shell profile. That creates persistent secret material in a hidden home-directory file.
High
Generic API/secret keys
echo 'export OPENROUTER_API_KEY="sk-or-v1-your_key"' >> ~/.bashrc # or ~/.zshrc
The example writes an API key into a shell startup file. Users copying it with a real key could persist credentials in a broadly readable profile.
High
Generic API/secret keys
gen = ScientificSchematicGenerator(api_key="your_key")
The Python example places an API key directly in source code. This can lead users to hardcode credentials in scripts.
High
Generic API/secret keys
echo $OPENROUTER_API_KEY
The troubleshooting command prints the API key value to the terminal. That can leak secrets into terminal scrollback, logs, or screen recordings.
High
Hidden file in home directory
# Set permanently (add to ~/.bashrc or ~/.zshrc)
The line explicitly recommends permanent shell-profile storage for the API key. This is a persistent hidden-file credential risk.
High
Hidden file in home directory
echo 'export OPENROUTER_API_KEY="your_key"' >> ~/.bashrc
The command appends an API key export into a shell profile. That stores a reusable secret in a hidden home-directory file.
High
Generic API/secret keys
echo "OPENROUTER_API_KEY=sk-or-v1-..." >> .env
The example writes an API key into a project .env file. If copied without safeguards, the secret may be committed or shared.
High
Generic API/secret keys
api_key="your_key",
The Python API example passes an API key literal in code. That pattern can train users to hardcode credentials.
High
Generic API/secret keys
echo $OPENROUTER_API_KEY
The troubleshooting command prints the API key. This can expose credentials in terminal history, logs, or collaborative sessions.
High
Generic API/secret keys
echo 'export OPENROUTER_API_KEY="your_key"' >> ~/.bashrc
The command stores an API key in a shell startup file. Persistent profile storage increases credential exposure risk.
High
Generic API/secret keys
parser.add_argument("--api-key", help="OpenRouter API key (or set OPENROUTER_API_KEY)")
The CLI accepts API keys as command-line arguments. That is convenient but can expose secrets through shell history and process inspection.
High
Generic API/secret keys
cmd.extend(["--api-key", api_key])
The wrapper appends the API key to the child process command arguments. Command-line secrets can appear in process listings and audit logs.
High
Generic API/secret keys
api_key="your_openrouter_key",
The Python API documentation shows an API key literal in source code. Users may copy this pattern and commit real credentials.
Medium
Hidden file access
echo 'export OPENROUTER_API_KEY="sk-or-v1-your_key"' >> ~/.bashrc # or ~/.zshrc
The shell profile write is intentional hidden-file access. It is user-initiated but still creates a persistent secret storage risk.
Medium
Hidden file access
# Set permanently (add to ~/.bashrc or ~/.zshrc)
The documentation directs access to shell profile files. This is user-initiated but still a hidden-file credential storage pattern.
Medium
Hidden file access
echo 'export OPENROUTER_API_KEY="your_key"' >> ~/.bashrc
The command writes to a hidden shell profile file. It is a real filesystem risk because it persists API credentials.
Medium
Unix shell invocation
#!/bin/bash
The file is an executable Bash example that creates an output directory and runs the generator scripts. It is user-initiated and simple, but it is still executable shell content.
Medium
Python file write/append
with open(iter_path, "wb") as f:
The script writes generated images, copies the final output, or writes review logs to user-selected paths. This is expected functionality but still real filesystem write capability.
Medium
Python file write/append
with open(log_path, "w") as f:
The script writes generated images, copies the final output, or writes review logs to user-selected paths. This is expected functionality but still real filesystem write capability.
Medium
Python shutil operations
shutil.copy(final_iter_path, output_path)
The script writes generated images, copies the final output, or writes review logs to user-selected paths. This is expected functionality but still real filesystem write capability.
Medium
dotenv library
load_dotenv(dotenv_path=env_path, override=False)
The code loads .env files, including parent-directory locations. This may import secrets from nearby projects without explicit user selection.
Medium
dotenv library
load_dotenv(dotenv_path=env_path, override=False)
The code loads .env files, including parent-directory locations. This may import secrets from nearby projects without explicit user selection.
Medium
dotenv library
load_dotenv(dotenv_path=env_path, override=False)
The code loads .env files, including parent-directory locations. This may import secrets from nearby projects without explicit user selection.
Medium
Python dotenv loader
load_dotenv(dotenv_path=env_path, override=False)
The code loads .env files, including parent-directory locations. This may import secrets from nearby projects without explicit user selection.
Medium
Python dotenv loader
load_dotenv(dotenv_path=env_path, override=False)
The code loads .env files, including parent-directory locations. This may import secrets from nearby projects without explicit user selection.
Medium
Python dotenv loader
load_dotenv(dotenv_path=env_path, override=False)
The code loads .env files, including parent-directory locations. This may import secrets from nearby projects without explicit user selection.
Low
HTTP client library
def _make_request(self, model: str, messages: List[Dict[str, Any]],
The generator makes outbound OpenRouter API requests using user prompts and generated images. This is intended behavior, but it is real external network access.
Low
HTTP client library
response = self._make_request(
The generator makes outbound OpenRouter API requests using user prompts and generated images. This is intended behavior, but it is real external network access.
Low
HTTP client library
response = self._make_request(
The generator makes outbound OpenRouter API requests using user prompts and generated images. This is intended behavior, but it is real external network access.
Low
Python HTTP libraries
response = requests.post(
The generator makes outbound OpenRouter API requests using user prompts and generated images. This is intended behavior, but it is real external network access.
Low
Hardcoded URL
self.base_url = "https://openrouter.ai/api/v1"
The generator makes outbound OpenRouter API requests using user prompts and generated images. This is intended behavior, but it is real external network access.
Low
Python getenv function
self.api_key = api_key or os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
Python getenv function
self.api_key = os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
Python getenv function
api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
getenv function call
self.api_key = api_key or os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
getenv function call
self.api_key = os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
getenv function call
api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
Python getenv function
api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Low
getenv function call
api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")
The code reads the OPENROUTER_API_KEY environment variable. The access is scoped to the expected credential, but it is still real secret access.
Risk Factors
🌐 Network access (23)
references/QUICK_REFERENCE.md:8 references/README.md:59 references/README.md:270 scripts/example_usage.sh:21 scripts/generate_schematic_ai.py:179 scripts/generate_schematic_ai.py:362 scripts/generate_schematic_ai.py:516 scripts/generate_schematic_ai.py:210 scripts/generate_schematic_ai.py:230 scripts/generate_schematic_ai.py:232 scripts/generate_schematic_ai.py:162 scripts/generate_schematic_ai.py:167 scripts/generate_schematic_ai.py:169 scripts/generate_schematic_ai.py:195 scripts/generate_schematic.py:97 SKILL.md:79 SKILL.md:526 SKILL.md:527 SKILL.md:528 SKILL.md:531 SKILL.md:532 SKILL.md:533 SKILL.md:605
📁 Filesystem access (10)
references/QUICK_REFERENCE.md:12 references/QUICK_REFERENCE.md:12 references/README.md:249 references/README.md:250 references/README.md:249 references/README.md:250 scripts/example_usage.sh:77 scripts/generate_schematic_ai.py:676 scripts/generate_schematic_ai.py:733 scripts/generate_schematic_ai.py:728
🔑 Env variables (66)
references/QUICK_REFERENCE.md:9 references/QUICK_REFERENCE.md:12 references/QUICK_REFERENCE.md:118 references/QUICK_REFERENCE.md:136 references/QUICK_REFERENCE.md:139 references/QUICK_REFERENCE.md:193 references/README.md:13 references/README.md:62 references/README.md:65 references/README.md:143 references/README.md:244 references/README.md:247 references/README.md:250 scripts/example_usage.sh:5 scripts/example_usage.sh:18 scripts/example_usage.sh:19 scripts/example_usage.sh:22 scripts/example_usage.sh:26 scripts/generate_schematic_ai.py:149 scripts/generate_schematic_ai.py:154 scripts/generate_schematic_ai.py:801 scripts/generate_schematic_ai.py:149 scripts/generate_schematic_ai.py:154 scripts/generate_schematic_ai.py:801 scripts/generate_schematic_ai.py:44 scripts/generate_schematic_ai.py:46 scripts/generate_schematic_ai.py:51 scripts/generate_schematic_ai.py:59 scripts/generate_schematic_ai.py:70 scripts/generate_schematic_ai.py:44 scripts/generate_schematic_ai.py:51 scripts/generate_schematic_ai.py:59 scripts/generate_schematic_ai.py:70 scripts/generate_schematic_ai.py:12 scripts/generate_schematic_ai.py:140 scripts/generate_schematic_ai.py:145 scripts/generate_schematic_ai.py:148 scripts/generate_schematic_ai.py:149 scripts/generate_schematic_ai.py:152 scripts/generate_schematic_ai.py:154 scripts/generate_schematic_ai.py:156 scripts/generate_schematic_ai.py:158 scripts/generate_schematic_ai.py:159 scripts/generate_schematic_ai.py:160 scripts/generate_schematic_ai.py:161 scripts/generate_schematic_ai.py:193 scripts/generate_schematic_ai.py:781 scripts/generate_schematic_ai.py:794 scripts/generate_schematic_ai.py:801 scripts/generate_schematic_ai.py:802 scripts/generate_schematic_ai.py:803 scripts/generate_schematic_ai.py:805 scripts/generate_schematic_ai.py:815 scripts/generate_schematic.py:93 scripts/generate_schematic.py:93 scripts/generate_schematic.py:71 scripts/generate_schematic.py:86 scripts/generate_schematic.py:93 scripts/generate_schematic.py:94 scripts/generate_schematic.py:95 scripts/generate_schematic.py:99 scripts/generate_schematic.py:122 scripts/generate_schematic.py:123 SKILL.md:76 SKILL.md:261 SKILL.md:603
⚙️ External commands (58)
scripts/example_usage.sh:1 scripts/generate_schematic.py:130 SKILL.md:43-55 SKILL.md:55-75 SKILL.md:75-77 SKILL.md:77-129 SKILL.md:129-131 SKILL.md:131-161 SKILL.md:161-173 SKILL.md:173-177 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-193 SKILL.md:193-206 SKILL.md:206-230 SKILL.md:230-248 SKILL.md:248-256 SKILL.md:256-280 SKILL.md:280-284 SKILL.md:284-305 SKILL.md:305-310 SKILL.md:310-314 SKILL.md:314-317 SKILL.md:317-321 SKILL.md:321-324 SKILL.md:324-328 SKILL.md:328-331 SKILL.md:331-335 SKILL.md:335-338 SKILL.md:338-342 SKILL.md:342-347 SKILL.md:347-358 SKILL.md:358-361 SKILL.md:361-373 SKILL.md:373-376 SKILL.md:376-389 SKILL.md:389-392 SKILL.md:392-402 SKILL.md:402-410 SKILL.md:410-419 SKILL.md:419-443 SKILL.md:443-455 SKILL.md:455-465 SKILL.md:465-469 SKILL.md:469-475 SKILL.md:475-480 SKILL.md:480-494 SKILL.md:494-500 SKILL.md:500-505 SKILL.md:505-520 SKILL.md:520-521 SKILL.md:521-578 SKILL.md:578-587 SKILL.md:587-594 SKILL.md:594-601 SKILL.md:601-606 SKILL.md:606-611 SKILL.md:611-613
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/k-dense-ai-scientific-schematics/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/k-dense-ai-scientific-schematics?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/k-dense-ai-scientific-schematics?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/k-dense-ai-scientific-schematics/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/k-dense-ai-scientific-schematics.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
K-Dense-AI. (2026). scientific-schematics security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/k-dense-ai-scientific-schematics/audits/7BibTeX citation
@techreport{k-dense-ai-k-dense-ai-scientific-schematics-2026,
author = {K-Dense-AI},
title = {scientific-schematics security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/k-dense-ai-scientific-schematics/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scientific-schematics security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "K-Dense-AI"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/k-dense-ai-scientific-schematics/audits/7"
identifiers:
- type: other
value: "skillstore:k-dense-ai-scientific-schematics:audit:7"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
k-dense-ai-scientific-schematics
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 15
Updated
2026-08-21
davila7-scientific-schematics
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 68
Architecture
85
Maintainability
87
Content
75
Community
78
Spec Compliance
What You Can Build
Create Manuscript Figures
Generate first drafts of flowcharts, pathways, and study diagrams for papers and preprints.
Explain Model Architectures
Turn neural network and system architecture descriptions into labeled visual diagrams.
Prepare Grant Visuals
Create polished workflow and mechanism diagrams for proposals, posters, and slide decks.
Try These Prompts
Basic Scientific Diagram
Create a scientific schematic for [topic]. Include the main components, clear labels, and a left-to-right flow.
Publication Flowchart
Generate a [CONSORT or PRISMA] flowchart for [study]. Include counts, exclusion reasons, group assignments, and final analysis totals.
Technical Architecture Diagram
Create an architecture diagram for [system]. Show each module, data flow direction, interface labels, and separate input, processing, and output layers.
Publication Quality Refinement
Generate a journal-ready schematic for [figure purpose]. Use colorblind-safe colors, readable labels, units where needed, and a clean layout for [journal or document type].
Best Practices
- Describe the diagram type, components, labels, and flow direction in the first prompt.
- Use environment variables or a secret manager for API keys instead of command-line arguments.
- Review generated images, captions, and logs before sharing or submitting work.
Avoid
- Do not use vague prompts such as only naming the diagram type.
- Do not include confidential unpublished data unless external API processing is approved.
- Do not commit generated logs, local environment files, or API keys to source control.
Frequently Asked Questions
Does this skill need network access?
Yes. It sends generation and review requests to OpenRouter-hosted models.
Can it create diagrams without an API key?
No. The scripts require an OpenRouter API key for AI image generation.
What diagram types are supported?
It supports scientific flowcharts, pathways, circuits, system diagrams, block diagrams, and neural network architectures.
Are results ready for journal submission?
They are designed for publication quality, but users must verify accuracy, labels, format, and journal requirements.
Where are generated files stored?
The scripts write output images, iteration images, and review logs to the chosen output directory.
Does it work with Claude Code and Codex?
Yes. The marketplace metadata lists Claude, Codex, and Claude Code support.
Developer Details
Author
K-Dense-AILicense
MIT license
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
a25199bc7d6b82598536822d1738eb5d5f54025b
Maintenance freshness
7/18/2026
Usage
12 downloads · 546 views
File structure