rowan

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the installation of the rowan-python package via uv. This is a standard procedure for Python-based AI agent skills to interact with external services.
  • [CREDENTIALS_UNSAFE]: The skill uses the ROWAN_API_KEY environment variable for authentication. It provides standard guidance for setting this variable or configuring the API key within a script, using placeholders for example values.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with the Rowan Science API to perform computational chemistry tasks. This is the primary intended function of the skill and involves communication with a known domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as SMILES strings and protein structure files (PDB/mmCIF). While these represent an ingestion surface for untrusted data, the skill includes mentions of validation errors and standard chemical parsing, which are appropriate for this use case. 1. Ingestion points: Protein structure files (PDB, mmCIF), SMILES strings, and protein sequences ingested via API methods like upload_protein and submit_docking_workflow. 2. Boundary markers: The documentation recommends using RDKit to validate SMILES strings before submission and mentions that the API validates input and raises rowan.ValidationError. 3. Capability inventory: The skill performs network operations via the Rowan API and supports writing results to local files (e.g., result.best_pose.write("best_pose.pdb")). 4. Sanitization: The skill relies on library-level validation and explicitly recommends pre-submission verification of chemical identifiers.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 02:14 AM