rdkit-chemdraw-cdxml
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the epam.indigo package for rendering ChemDraw files into PNGs. EPAM Systems is a well-known global provider of life sciences and engineering software, making this a trusted source for scientific dependencies.\n- [PROMPT_INJECTION]: The skill ingests and processes chemical data from SMILES strings and CDXML files, which creates a surface for indirect prompt injection if malicious data is provided.\n
- Ingestion points: Untrusted data enters the skill's workflow through file reading operations in check_scheme.py and build_reaction_scheme.py, which are then passed to rdkit.Chem.rdChemDraw and xml.etree.ElementTree.fromstring.\n
- Boundary markers: The skill does not implement specific boundary markers or delimiters to isolate processed chemical data from the agent's instructional context.\n
- Capability inventory: The skill has permissions to write files to the local file system and render images through the Indigo library.\n
- Sanitization: The skill leverages RDKit's built-in molecule sanitization (Chem.SanitizeMol) to validate chemical structures and uses standard XML parsing libraries to ensure document structure.
Audit Metadata