pubchem-database
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches chemical compound data, bioactivity information, and molecular structures from the National Center for Biotechnology Information (NCBI) PubChem PUG-REST API. This is an established and well-known scientific service.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the PubChem database, which represents an untrusted data source that could theoretically contain malicious instructions.
- Ingestion points: The scripts
scripts/bioactivity_query.pyandscripts/compound_search.pyingest data frompubchem.ncbi.nlm.nih.govvia therequestslibrary and thepubchempywrapper. - Boundary markers: The instructions do not define specific delimiters or instructions to the agent to ignore potentially malicious content embedded within retrieved chemical metadata or synonyms.
- Capability inventory: The skill utilizes network requests to reach PubChem APIs and provides file-writing capabilities through the
pubchempy.download()function to save chemical structure files. - Sanitization: Data is parsed using standard JSON decoders and object mappers without specific filtering or sanitization of the content for prompt injection patterns.
Audit Metadata