autodock-vina-docking
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes external command-line tools like
prepare_receptorandprepare_flexreceptorfrom the ADFR Suite using Python'ssubprocess.runto perform protein file conversion. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data such as PDB IDs and SMILES strings and possesses system-level capabilities including file writing and shell execution. This creates a vulnerability surface if the input values are sourced from an adversary without proper validation.
- Ingestion points:
prody.fetchPDB(PDB ID) andChem.MolFromSmiles(SMILES strings) inSKILL.md. - Boundary markers: Not present in the provided scripts.
- Capability inventory:
subprocess.runfor receptor preparation andopen().write()for PDBQT files. - Sanitization: No explicit sanitization of PDB IDs or SMILES strings is shown before they are used in file paths or command arguments.
- [EXTERNAL_DOWNLOADS]: The skill fetches protein structures from the Protein Data Bank using the ProDy library and directs users to download the ADFR Suite from the Scripps Research Institute. These are well-known scientific data sources and academic institutions.
Audit Metadata