pubmed-search

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches citation data and abstracts from the official NCBI PubMed API endpoints at eutils.ncbi.nlm.nih.gov. This is a well-known scientific service provided by the US National Library of Medicine.
  • [COMMAND_EXECUTION]: Shell commands are used to perform HTTP requests via curl and to parse the resulting JSON data using python3. The python script used is a static inline command for data processing and does not execute remote logic.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection surfaces as it processes uncontrolled external data (paper titles and abstracts) from the PubMed database.
  • Ingestion points: Data retrieved from the esearch and efetch API endpoints.
  • Boundary markers: Not present; the agent is instructed to report the results exactly as returned by the API.
  • Capability inventory: Access to curl for network requests and python3 for JSON parsing.
  • Sanitization: No specific sanitization or filtering is applied to the retrieved biomedical text before presentation to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 11:30 PM
Security Audit — agent-trust-hub — pubmed-search