技能 scientific-schematics

📦

scientific-schematics

Name: scientific-schematics
Author: davila7

内容修订 r2 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

生成出版级科学示意图

研究人员需要清晰的科学图示，而不必手动重新绘制图表。此技能会生成出版风格的示意图，并根据特定文档的质量目标对其进行审查。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "scientific-schematics" from https://skillstore.io/skills/davila7-scientific-schematics.md and its manifest at https://skillstore.io/api/skills/davila7-scientific-schematics/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/davila7-scientific-schematics.md 已签名 manifest GET /api/skills/davila7-scientific-schematics/manifest 已签名 lockfile GET /api/skills/davila7-scientific-schematics/lockfile

测试它

正在使用“scientific-schematics”。一位研究人员请求为一项随机试验生成 CONSORT 受试者流程图。

预期结果:

带版本的 PNG 文件展示筛选、排除、随机分组、随访和分析组。
审查日志记录质量评分和改进建议。

正在使用“scientific-schematics”。一名学生请求为演示文稿生成 Transformer 架构图。

预期结果:

生成的图示展示带注意力连接的编码器和解码器模块。
审查步骤检查可读性、标签质量和布局清晰度。

正在使用“scientific-schematics”。一位文档作者需要为技术报告生成系统工作流程示意图。

预期结果:

输出图像展示模块、箭头和带标签的数据流动。
最终副本保存在请求的输出路径。

安全审计

高风险

v9 • 2026/7/23 打开版本化报告

Most static alerts are false positives caused by Markdown fences, placeholder key names, documentation links, and test code. Confirmed risks include OpenRouter data transmission, plaintext credential guidance, broad ancestor .env loading, and API-key exposure in child-process arguments.

已扫描文件

3,025

分析行数

复核项

已忽略误报

已确认安全问题 (4)

高

README.md:65

Environment file access

echo "OPENROUTER_API_KEY=sk-or-v1-..." >> .env

The command creates or extends a .env file containing a plaintext API key. No adjacent safeguard prevents version-control inclusion or overly broad file permissions.

高

scripts/generate_schematic_ai.py:57

Environment file access

env_path = cwd / ".env"

The code probes ancestor directories for .env files rather than limiting access to an explicit project path. This may read unrelated credential files.

高

scripts/generate_schematic_ai.py:68

Environment file access

env_path = script_dir / ".env"

The package-directory search walks upward looking for .env files. That scope can cross the skill boundary and select credentials from a parent workspace.

高

scripts/generate_schematic.py:122-130

API Key Exposed in Child Process Arguments

The wrapper appends the OpenRouter API key to the child command. Process inspection can reveal the credential even when it originated in the environment.

The command list explicitly receives api_key before subprocess.run executes it. Python list arguments avoid shell injection but remain visible as process arguments.

能力复核项 (26)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

QUICK_REFERENCE.md:12

Hidden file in home directory

echo 'export OPENROUTER_API_KEY="sk-or-v1-your_key"' >> ~/.bashrc # or ~/.zshrc

The command appends a plaintext API key export to a persistent shell startup file. This can expose the credential through backups, file reads, or accidental sharing.

高

QUICK_REFERENCE.md:12

Generic API/secret keys

echo 'export OPENROUTER_API_KEY="sk-or-v1-your_key"' >> ~/.bashrc # or ~/.zshrc

This instruction persists the OpenRouter API key in a shell startup file. The key remains readable as plaintext outside the immediate process.

高

QUICK_REFERENCE.md:136

Generic API/secret keys

echo $OPENROUTER_API_KEY

The troubleshooting command prints the live OpenRouter API key to the terminal. Terminal capture, logs, or screen sharing can disclose the credential.

高

README.md:250

Hidden file in home directory

echo 'export OPENROUTER_API_KEY="your_key"' >> ~/.bashrc

The documented command appends a plaintext API key to ~/.bashrc. This creates persistent credential exposure in a commonly backed-up configuration file.

高

README.md:65

Generic API/secret keys

echo "OPENROUTER_API_KEY=sk-or-v1-..." >> .env

The command writes an API key into a project .env file without also establishing restrictive permissions or exclusion from version control. This can lead to accidental secret disclosure.

高

README.md:244

Generic API/secret keys

echo $OPENROUTER_API_KEY

The command prints the complete API key to standard output. Shell recording, logs, or screen sharing can expose the credential.

高

README.md:250

Generic API/secret keys

echo 'export OPENROUTER_API_KEY="your_key"' >> ~/.bashrc

The instruction persists the OpenRouter API key as plaintext in ~/.bashrc. This broadens credential lifetime and access beyond the generation process.

高

scripts/generate_schematic_ai.py:794

Generic API/secret keys

parser.add_argument("--api-key", help="OpenRouter API key (or set OPENROUTER_API_KEY)")

The CLI accepts an API key as a command-line argument. Such secrets can remain in shell history and can be visible in process listings.

高

scripts/generate_schematic_ai.py:801

Generic API/secret keys

api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")

This line permits the API key to originate from args.api_key. Command-line secrets can be exposed through shell history and operating-system process inspection.

高

scripts/generate_schematic.py:130

Python subprocess.run

result = subprocess.run(cmd, check=False)

The subprocess uses an argument list, which prevents shell injection, but the list includes the API key from line 123. The child command therefore exposes the credential in process arguments.

高

scripts/generate_schematic.py:86

Generic API/secret keys

help="OpenRouter API key (or use OPENROUTER_API_KEY env var)")

The wrapper offers a --api-key option for a sensitive credential. Command-line entry can disclose the key through shell history and process listings.

高

scripts/generate_schematic.py:93

Generic API/secret keys

api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")

The wrapper obtains the live key here and forwards it through argv at line 123. This creates avoidable command-line credential exposure.

高

scripts/generate_schematic.py:123

Generic API/secret keys

cmd.extend(["--api-key", api_key])

The API key value is directly appended to the subprocess argument list. Other local processes may be able to read it while the child is running.

中

QUICK_REFERENCE.md:12

Hidden file access

echo 'export OPENROUTER_API_KEY="sk-or-v1-your_key"' >> ~/.bashrc # or ~/.zshrc

The command writes credential material into ~/.bashrc or ~/.zshrc. Persistent plaintext storage in a home configuration file is a real credential-exposure risk.

中

README.md:250

Hidden file access

echo 'export OPENROUTER_API_KEY="your_key"' >> ~/.bashrc

The command writes credential material into a hidden home configuration file. That persistence is unnecessary and increases accidental disclosure risk.

低

scripts/generate_schematic_ai.py:179

HTTP client library

def _make_request(self, model: str, messages: List[Dict[str, Any]],

This method implements outbound API requests to OpenRouter. User prompts and, during review, generated image data leave the local environment.

低

scripts/generate_schematic_ai.py:362

HTTP client library

response = self._make_request(

The generation path invokes the OpenRouter request helper with the user's diagram prompt. This is expected functionality but is real external data transmission.

低

scripts/generate_schematic_ai.py:516

HTTP client library

response = self._make_request(

The review path sends the generated image and review prompt to OpenRouter. Scientific content may therefore be disclosed to a third-party service.

低

scripts/generate_schematic_ai.py:210

Python HTTP libraries

response = requests.post(

requests.post performs an HTTPS request to the configured OpenRouter endpoint with authorization and message content. This is a genuine network side effect.

低

scripts/generate_schematic_ai.py:167

Hardcoded URL

self.base_url = "https://openrouter.ai/api/v1"

This URL is the active base for outbound generation and review requests. It establishes OpenRouter as the external recipient of prompts and images.

低

scripts/generate_schematic_ai.py:59

dotenv library

load_dotenv(dotenv_path=env_path, override=False)

The loader reads the first .env file found while walking ancestor directories. It can select credentials from an unrelated parent project without an explicit path.

低

scripts/generate_schematic_ai.py:70

dotenv library

load_dotenv(dotenv_path=env_path, override=False)

The loader searches upward from the script directory and imports a discovered .env file. This can consume credentials outside the intended skill directory.

低

scripts/generate_schematic_ai.py:59

Python dotenv loader

load_dotenv(dotenv_path=env_path, override=False)

load_dotenv imports variables from an automatically discovered ancestor .env file. The broad search can use an unintended OpenRouter credential.

低

scripts/generate_schematic_ai.py:70

Python dotenv loader

load_dotenv(dotenv_path=env_path, override=False)

load_dotenv imports a .env file found by walking parent directories from the package path. The credential source is not explicitly selected by the user.

低

scripts/generate_schematic.py:93

Python getenv function

api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")

The wrapper reads OPENROUTER_API_KEY and later appends its value to the child process command. This converts a process-scoped secret into a visible command-line argument.

低

scripts/generate_schematic.py:93

getenv function call

api_key = args.api_key or os.getenv("OPENROUTER_API_KEY")

The environment lookup supplies a key that the wrapper forwards in child-process arguments. Local process inspection can reveal that credential.

风险因素

⚙️ 外部命令 (50)

example_usage.sh:1 scripts/generate_schematic.py:130 SKILL.md:40-52 SKILL.md:52-72 SKILL.md:72-74 SKILL.md:74-126 SKILL.md:126-128 SKILL.md:128-158 SKILL.md:158-170 SKILL.md:170-174 SKILL.md:174-176 SKILL.md:176-178 SKILL.md:178-190 SKILL.md:190-203 SKILL.md:203-227 SKILL.md:227-245 SKILL.md:245-253 SKILL.md:253-277 SKILL.md:277-281 SKILL.md:281-302 SKILL.md:302-307 SKILL.md:307-311 SKILL.md:311-314 SKILL.md:314-318 SKILL.md:318-321 SKILL.md:321-325 SKILL.md:325-328 SKILL.md:328-332 SKILL.md:332-335 SKILL.md:335-339 SKILL.md:339-344 SKILL.md:344-355 SKILL.md:355-358 SKILL.md:358-370 SKILL.md:370-373 SKILL.md:373-386 SKILL.md:386-389 SKILL.md:389-399 SKILL.md:399-407 SKILL.md:407-416 SKILL.md:416-440 SKILL.md:440-452 SKILL.md:452-462 SKILL.md:462-466 SKILL.md:466-472 SKILL.md:472-477 SKILL.md:477-491 SKILL.md:491-497 SKILL.md:497-502 SKILL.md:502-517

🌐 网络访问 (23)

📁 文件系统访问 (10)

example_usage.sh:77 QUICK_REFERENCE.md:12 QUICK_REFERENCE.md:12 README.md:249 README.md:250 README.md:249 README.md:250 scripts/generate_schematic_ai.py:676 scripts/generate_schematic_ai.py:733 scripts/generate_schematic_ai.py:728

🔑 环境变量 (50)

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/davila7-scientific-schematics/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-scientific-schematics/security.svg)](https://skillstore.io/skills/davila7-scientific-schematics?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/davila7-scientific-schematics?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-scientific-schematics/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/davila7-scientific-schematics.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

davila7. (2026). scientific-schematics security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-scientific-schematics/audits/9

BibTeX 引用

@techreport{davila7-davila7-scientific-schematics-2026,
  author = {davila7},
  title = {scientific-schematics security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/davila7-scientific-schematics/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scientific-schematics security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-scientific-schematics/audits/9"
identifiers:
  - type: other
    value: "skillstore:davila7-scientific-schematics:audit:9"
    description: "Skillstore immutable audit report identifier"

比较变体

2 个可安装变体

每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。

为什么此变体排名第一

Skillstore 使用量更高

作者 / 来源 Skillstore 评分证据置信度 Skillstore 使用量已更新

K-Dense-AI 推荐

k-dense-ai-scientific-schematics

Skillstore 评分 38

证据置信度中

Skillstore 使用量 19

已更新

2026-09-09

davila7 当前

davila7-scientific-schematics

Skillstore 评分 38

证据置信度中

Skillstore 使用量 9

已更新

2026-09-09

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

创建手稿图示

为早期手稿草稿生成 CONSORT 流程、通路和机制图。

准备论文视觉材料

将方法描述转换为适用于章节、答辩和海报的清晰图示。

起草技术图表

创建带审查备注的架构和工作流程示意图，供文档团队使用。

试试这些提示

开始绘制基础图表

使用 scientific-schematics 生成一个关于 [topic] 的简单图表。包含主要组件、标签和流程方向。

添加出版约束

为 [topic] 生成一个 [journal/poster/presentation] 示意图。使用清晰标签、高对比度和从左到右的布局。

优化复杂系统

创建一个展示 [system] 的示意图。包含每个模块、数据流、关键注释和无障碍友好的颜色。

生成可供审查的输出

为 [study] 生成一张出版就绪的图示。应用期刊阈值，保存带版本的输出，并总结质量问题。

最佳实践

在提示中给出精确的组件名称、数量和流程方向。
选择与图示最终用途匹配的文档类型。
在共享或发表前，审查生成图像的科学准确性。

避免

不要使用诸如 make a diagram 这样模糊的提示。
不要将生成的标签或关系视为自动正确。
不要在共享 shell 配置文件或代码仓库中存储长期有效的 API 密钥。

常见问题

这个技能需要 API 密钥吗？

是。它需要 OpenRouter API 密钥来进行图像生成和审查。

它可以创建期刊就绪的图示吗？

它可以创建出版风格的草稿，但每张图都应由领域专家验证。

它会创建哪些文件？

它会保存带版本的图像文件、最终图像副本和审查日志。

它可以离线工作吗？

不能。生成和审查步骤会通过 OpenRouter 调用外部 AI 模型。

我可以从 Python 中使用它吗？

可以。该仓库包含一个 Python 生成器类和命令行包装器。

哪些图表最适合？

它最适合流程图、架构图、通路图、电路图和科学过程图。

开发者详情

作者

davila7

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/davila7/claude-code-templates/tree/main/cli-tool/components/skills/scientific/scientific-schematics

引用

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

维护新鲜度

2026/7/28

使用量

5 次下载 · 537 次浏览

文件结构

📄 example_usage.sh

📄 QUICK_REFERENCE.md

📄 README.md

📁 references/

📄 best_practices.md

📁 scripts/

📄 generate_schematic_ai.py

📄 generate_schematic.py

📄 SKILL.md

📄 test_ai_generation.py