pubchem-compound-search
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes data from the external PubChem PUG-REST API, creating a surface for indirect prompt injection.
- Ingestion points: Data from pubchem.ncbi.nlm.nih.gov (JSON, SDF, PNG) is fetched and processed in Python scripts.
- Boundary markers: None. The skill does not instruct the agent to use delimiters or treat the API output as untrusted content.
- Capability inventory: Python code includes file writing (saving SDF and PNG files) and network requests.
- Sanitization: External data is handled directly without escaping or validation.
- [COMMAND_EXECUTION]: Instructions provide standard commands to install well-known Python packages (requests and pandas).
- [EXTERNAL_DOWNLOADS]: Retrieves chemical datasets, molecular properties, and structure files from the authoritative PubChem service.
Audit Metadata