openalex-database
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
requestslibrary to interact with the OpenAlex API (api.openalex.org). This is a well-known scholarly database service. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted scholarly metadata (such as titles and abstracts) retrieved from the OpenAlex API, which presents a surface for indirect prompt injection.
- Ingestion points: Data is ingested through the
OpenAlexClientinscripts/openalex_client.pyand processed by helper functions inscripts/query_helpers.py. - Boundary markers: No explicit delimiters or instructions to ignore embedded content were found in the processing scripts.
- Capability inventory: The skill possesses network access capabilities (via
requests) and includes examples of writing data to the local file system (CSV export). - Sanitization: The scripts do not implement specific sanitization or filtering for the metadata returned by the API before it is handled by the agent.
Audit Metadata