Figure Legend Gen

Generate standardized figure legends for scientific charts and graphs. Trigger when user uploads/requesting legend for research figures, academic papers, or...

Security Scan

The skill appears to implement a local figure-legend generator and asks for no credentials, but its documentation and metadata claim network/API activity and list dependencies that aren't present in requirements.txt — this mismatch warrants caution and clarification before installing or running on sensitive data.

Purpose & Capability

Name/description match the included script: a local Python tool that generates figure legends from an image and templates. However, SKILL.md and metadata label the skill as 'Hybrid (Tool/Script + Network/API)' and list 'Network Access' as high risk while the provided code (visible portion) contains no network calls. Also SKILL.md names PIL and pytesseract as dependencies but requirements.txt does not include them. These inconsistencies suggest the metadata/README and code are out-of-sync.

Instruction Scope

Runtime instructions tell the agent to run the local Python script on a provided image path and to install requirements.txt. The script validates and reads local files and writes output; there are no instructions to collect unrelated system data. But SKILL.md contains a 'Network/API' claim and a security checklist referencing HTTPS and external APIs; the instructions do not show what external endpoints would be used. The file listing of main.py was truncated in the package summary; the missing tail could contain network calls — this uncertainty increases risk.

Install Mechanism

No install spec is provided (instruction-only + included script). There are no downloads or external installers in the manifest. This is low-risk from an install-mechanism perspective.

Credentials

The skill declares no required environment variables, no credentials, and no special config paths. The code shown only needs access to the input image and optional output path — proportional to the stated purpose.

Persistence & Privilege

Skill flags indicate normal user-invocable behavior and always:false. The package does not request elevated/system persistence or modifications to other skills. No concern here.

What to consider before installing

Before installing or running this skill: 1) Ask the author to explain why SKILL.md claims network/API usage and a 'High' network risk if the included script appears purely local; confirm there are no external endpoints used. 2) Inspect the full scripts/main.py (the manifest listing was truncated) to verify there are no hidden network calls or code that exfiltrates files. 3) Fix dependency mismatches: requirements.txt does not list Pillow/pytesseract which the README references; ensure required packages are explicit and safe. 4) Run the tool in a sandbox or isolated environment the first time, and do not feed it sensitive or proprietary images until you confirm no external communication occurs. 5) If you need stronger assurance, request a signed provenance or a canonical source (homepage/author repo) and ask for reproducible build/install instructions that do not rely on unreviewed remote downloads.

Figure Legend Generator

Generate publication-quality figure legends for scientific research charts and images.

Supported Chart Types

Chart Type	Description
Bar Chart	Compare values across categories
Line Graph	Show trends over time or continuous data
Scatter Plot	Display relationships between variables
Box Plot	Show distribution and outliers
Heatmap	Display matrix data intensity
Microscopy	Fluorescence/confocal images
Flow Cytometry	FACS plots and histograms
Western Blot	Protein expression bands

Usage

python scripts/main.py --input <image_path> --type <chart_type> [--output <output_path>]

Parameters

Parameter	Required	Description
--input	Yes	Path to chart image
--type	Yes	Chart type (bar/line/scatter/box/heatmap/microscopy/flow/western)
--output	No	Output path for legend text (default: stdout)
--format	No	Output format (text/markdown/latex), default: markdown
--language	No	Language (en/zh), default: en

Examples

# Generate legend for bar chart
python scripts/main.py --input figure1.png --type bar

# Save to file
python scripts/main.py --input plot.jpg --type line --output legend.md

# Chinese output
python scripts/main.py --image.png --type scatter --language zh

Legend Structure

Generated legends follow academic standards:

1. Figure Number - Sequential numbering
2. Brief Title - Concise description
3. Main Description - What the figure shows
4. Data Details - Key statistics/measurements
5. Methodology - Brief experimental context
6. Statistics - P-values, significance markers
7. Scale Bars - For microscopy images

Technical Notes

• Difficulty: Low
• Dependencies: PIL, pytesseract (optional OCR)
• Processing: Vision analysis for chart type detection
• Output: Structured markdown by default

References

• references/legend_templates.md - Templates by chart type
• references/academic_style_guide.md - Formatting guidelines

Risk Assessment

Risk Indicator	Assessment	Level
Code Execution	Python scripts with tools	High
Network Access	External API calls	High
File System Access	Read/write data	Medium
Instruction Tampering	Standard prompt guidelines	Low
Data Exposure	Data handled securely	Medium

Security Checklist

• No hardcoded credentials or API keys
• No unauthorized file system access (../)
• Output does not expose sensitive information
• Prompt injection protections in place
• API requests use HTTPS only
• Input validated against allowed patterns
• API timeout and retry mechanisms implemented
• Output directory restricted to workspace
• Script execution in sandboxed environment
• Error messages sanitized (no internal paths exposed)
• Dependencies audited
• No exposure of internal service architecture

Prerequisites

# Python dependencies
pip install -r requirements.txt

Evaluation Criteria

Success Metrics

• Successfully executes main functionality
• Output meets quality standards
• Handles edge cases gracefully
• Performance is acceptable

Test Cases

1. Basic Functionality: Standard input → Expected output
2. Edge Case: Invalid input → Graceful error handling
3. Performance: Large dataset → Acceptable processing time

Lifecycle Status

• Current Stage: Draft
• Next Review Date: 2026-03-06
• Known Issues: None
• Planned Improvements:
  • Performance optimization
  • Additional feature support