materials-properties
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The 'workflows/best_practices.md' file contains code recommendations that use the 'pickle' module for saving and loading calculation metadata (e.g., 'metadata.pkl'). The use of 'pickle.load()' is insecure because it allows for the execution of arbitrary Python code during the deserialization process. This could be exploited if an attacker provides a malicious pickle file to the agent.\n- [PROMPT_INJECTION]: The skill operates by reading external materials structure files (such as CIF, POSCAR, and XYZ) using 'ase.io.read()', creating a surface for indirect prompt injection.\n
- Ingestion points: External structure files are ingested in 'SKILL.md', 'QUICK_REFERENCE.md', and various examples.\n
- Boundary markers: There are no boundary markers or instructions to the agent to ignore natural language instructions that might be embedded in the metadata or comments of these files.\n
- Capability inventory: The skill possesses extensive capabilities, including writing result files and optimization trajectories to the file system, and executing external scientific simulation tools (calculators like VASP, GPAW, and Quantum ESPRESSO) via subprocesses.\n
- Sanitization: The skill does not perform sanitization or rigorous validation of the input files to prevent the execution of malicious instructions embedded within the data.\n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install several third-party Python packages, including 'ase', 'spglib', 'matplotlib', 'phonopy', 'elastic', 'icet', 'pycalphad', and 'gpaw'. These are widely used and well-known scientific libraries in the research community, typically installed from standard registries like PyPI or Conda.
Audit Metadata