biomedical-search-strategy-builder

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The Python script scripts/main.py makes network requests to id.nlm.nih.gov using urllib.request. This targets the official National Library of Medicine (NLM) MeSH lookup service to verify medical terms. This is a well-known service and is integral to the skill's primary purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied research questions (PICO elements) to construct search strings. While this processes untrusted data, the risk is low because the skill is scoped strictly to text generation, lacks arbitrary code execution capabilities, and includes safety instructions to reject out-of-scope requests.
  • [SAFE]: The code includes robust input validation, such as checking for balanced parentheses and square brackets in search queries, which prevents potential syntax-based errors. The use of standard libraries and clear documentation aligns with safe development practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:43 PM