rowan
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the installation of the
rowan-pythonpackage viauv. This is a standard procedure for Python-based AI agent skills to interact with external services. - [CREDENTIALS_UNSAFE]: The skill uses the
ROWAN_API_KEYenvironment variable for authentication. It provides standard guidance for setting this variable or configuring the API key within a script, using placeholders for example values. - [EXTERNAL_DOWNLOADS]: The skill communicates with the Rowan Science API to perform computational chemistry tasks. This is the primary intended function of the skill and involves communication with a known domain.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as SMILES strings and protein structure files (PDB/mmCIF). While these represent an ingestion surface for untrusted data, the skill includes mentions of validation errors and standard chemical parsing, which are appropriate for this use case. 1. Ingestion points: Protein structure files (PDB, mmCIF), SMILES strings, and protein sequences ingested via API methods like
upload_proteinandsubmit_docking_workflow. 2. Boundary markers: The documentation recommends using RDKit to validate SMILES strings before submission and mentions that the API validates input and raisesrowan.ValidationError. 3. Capability inventory: The skill performs network operations via the Rowan API and supports writing results to local files (e.g.,result.best_pose.write("best_pose.pdb")). 4. Sanitization: The skill relies on library-level validation and explicitly recommends pre-submission verification of chemical identifiers.
Audit Metadata