chembl-search

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The skill communicates with the Valyu API at api.valyu.ai to retrieve molecular data. This network activity is documented, restricted to the official vendor domain, and essential for the tool's primary search function.
  • [CREDENTIALS_UNSAFE]: The skill manages a Valyu API key by storing it in a local configuration file at ~/.valyu/config.json. This method follows industry-standard practices for persistent credential management in CLI tools.
  • [COMMAND_EXECUTION]: The tool includes a bash wrapper and a Node.js script. Analysis of the source code confirms that command execution is scoped strictly to the search logic and does not involve arbitrary or unsafe shell calls.
  • [PROMPT_INJECTION]: The skill processes data from the ChEMBL database, creating an attack surface for indirect prompt injection. This is a low-risk factor inherent to search tools.
  • Ingestion points: API responses in scripts/search.mjs.
  • Boundary markers: None.
  • Capability inventory: Shell and Node.js execution.
  • Sanitization: Standard JSON parsing is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 03:10 AM