pubchem-database

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches chemical compound data, bioactivity information, and molecular structures from the National Center for Biotechnology Information (NCBI) PubChem PUG-REST API. This is an established and well-known scientific service.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the PubChem database, which represents an untrusted data source that could theoretically contain malicious instructions.
  • Ingestion points: The scripts scripts/bioactivity_query.py and scripts/compound_search.py ingest data from pubchem.ncbi.nlm.nih.gov via the requests library and the pubchempy wrapper.
  • Boundary markers: The instructions do not define specific delimiters or instructions to the agent to ignore potentially malicious content embedded within retrieved chemical metadata or synonyms.
  • Capability inventory: The skill utilizes network requests to reach PubChem APIs and provides file-writing capabilities through the pubchempy.download() function to save chemical structure files.
  • Sanitization: Data is parsed using standard JSON decoders and object mappers without specific filtering or sanitization of the content for prompt injection patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:54 PM