drug-discovery-search
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use the
findcommand to locate its internal scripts (scripts/search) within the local environment for execution. This is a functional requirement for path resolution on the host system. - [DATA_EXFILTRATION]: The tool manages a Valyu API key by storing it in a local configuration directory (
~/.valyu/config.json) and including it in headers for requests sent tohttps://api.valyu.ai/v1. This is standard behavior for an API-based utility and does not involve unauthorized access to system credentials or sensitive personal data. - [REMOTE_CODE_EXECUTION]: The script
scripts/search.mjsutilizes the Node.js built-infetchAPI to perform network requests to the official Valyu search endpoint. No external scripts or dependencies are downloaded or executed dynamically. - [PROMPT_INJECTION]: The skill ingests data from external drug databases (ChEMBL, DrugBank, FDA) which constitutes a potential surface for indirect prompt injection. However, the data is technical and structured in nature, and the skill does not possess high-risk capabilities that could be exploited via this vector.
Audit Metadata