pm-search
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external content from PubMed that could potentially contain malicious instructions designed to influence agent behavior. • Ingestion points: Fetches paper metadata from the NCBI E-utilities API (eutils.ncbi.nlm.nih.gov) in Step 2 of SKILL.md. • Boundary markers: Results are reported in Step 3 as a simple list without isolation markers or instructions to ignore embedded instructions. • Capability inventory: Utilizes mcp__chrome-devtools__navigate_page and mcp__chrome-devtools__evaluate_script. • Sanitization: No sanitization is performed on the data retrieved from the external API (e.g., titles, authors) before reporting to the context.
- [DYNAMIC_EXECUTION]: The skill constructs and executes JavaScript logic at runtime within the browser environment. • The evaluate_script call in SKILL.md involves interpolating user-provided keywords into a code block template.
- [EXTERNAL_DOWNLOADS]: The skill connects to official external services to retrieve information. • Fetches biomedical data and search results from the established eutils.ncbi.nlm.nih.gov domain.
- [COMMAND_EXECUTION]: The skill executes actions using browser automation tools. • Utilizes mcp__chrome-devtools__navigate_page to browse to PubMed and mcp__chrome-devtools__evaluate_script to perform API calls and metadata extraction.
Audit Metadata