chem-db-spectra
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/query_spectra.pyfetches spectroscopic data from the NIST Chemistry WebBook (webbook.nist.gov), which is a well-known scientific data repository. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing and storing untrusted data from an external website.
- Ingestion points: Data is retrieved from the NIST WebBook via HTTP GET requests in
scripts/query_spectra.py. - Boundary markers: None; the script saves the raw response body directly to the local file system.
- Capability inventory: The script has the ability to create directories (
os.makedirs) and write files (open().write()) on the agent's host system. - Sanitization: No validation or sanitization of the downloaded JCAMP-DX formatted content is performed prior to saving.
- [COMMAND_EXECUTION]: The script
scripts/query_spectra.pycontains a critical logic error at the end of themain()function. It attempts to import a missing local module (src.utils.config_utils) and references undefined variables (_params_path,_config), which will result in aNameErrororImportErrorat runtime.
Audit Metadata