pubchem-compound-search
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches chemical information, properties, and structure files from the official NCBI PubChem PUG-REST API domain (pubchem.ncbi.nlm.nih.gov).
- [COMMAND_EXECUTION]: Recommends the installation of standard, well-known Python libraries
requestsandpandasto facilitate API interaction and data management. - [DATA_EXFILTRATION]: Executes network requests to the well-known scientific service at
pubchem.ncbi.nlm.nih.govto retrieve molecular data based on user-provided identifiers. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection as it ingests large volumes of external chemical and assay data into the agent's context.
- Ingestion points: PUG-REST JSON responses containing compound names, descriptions, and assay summaries.
- Boundary markers: The data is handled as structured JSON; however, the skill does not explicitly specify delimiters for the final processed output.
- Capability inventory: The skill performs network requests and has the capability to write files to the local filesystem (e.g., saving SDF and PNG files).
- Sanitization: The skill utilizes standard programmatic JSON parsing for data ingestion.
Audit Metadata