grants
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
bash_toolto executecurlcommands for querying the NIH RePORTER API atapi.reporter.nih.gov. This is the documented and intended method for retrieving project data. - [EXTERNAL_DOWNLOADS]: The skill performs targeted fetches of Notice of Special Interest (NOSI) documents from
grants.nih.govusingweb_fetch. These requests are directed at official government documentation to provide users with accurate grant details. - [INDIRECT_PROMPT_INJECTION]: The skill ingests research ideas from users and external data from the Consensus research tool and NIH RePORTER. It mitigates risks by requiring specific research input (rejecting vague ideas) and enforcing strict data sourcing rules that prioritize tool results over model training knowledge. Every citation must have a retrievable URL from the current session.
- [SAFE]: The skill uses local Python scripts for deterministic logic, such as
fiscal_year_calculator.pyandmechanism_matcher.py, which do not perform network operations or dynamic code execution. All network activity is directed at trusted academic and government domains.
Audit Metadata