tamarind
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates interaction with the Tamarind Bio platform via its official REST API and MCP server. It explicitly instructs the agent and users on the secure handling of the
TAMARIND_API_KEY, recommending the use of environment variables or.envfiles rather than hardcoding credentials. - [SAFE]: The skill contains proactive security warnings, specifically advising against installing the PyPI package
tamarinddue to a name collision with an unrelated tool, which mitigates supply-chain confusion risks. - [INDIRECT_PROMPT_INJECTION]: The skill handles user-supplied molecular sequences and structure files which are processed by remote computational tools. While this represents an attack surface, the risk is inherent to the tool's scientific purpose and mitigated by schema validation.
- Ingestion points: Molecular sequences (amino-acid strings) and structure files (PDB, SDF, CIF) provided by the user in the
settingspayload or via file uploads. - Boundary markers: The instructions define chain delimiters (colon
:) for multimers and direct the agent to utilize thevalidateJobendpoint for schema and parameter verification before submission. - Capability inventory: The skill utilizes the
requestslibrary to perform network operations against the Tamarind Bio domain and writes result data (ZIP archives) to the local file system. - Sanitization: Relies on platform-side validation and the
validateJobAPI to ensure that inputs conform to expected biological and chemical formats.
Audit Metadata