chem-db-spectra

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/query_spectra.py fetches spectroscopic data from the NIST Chemistry WebBook (webbook.nist.gov), which is a well-known scientific data repository.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing and storing untrusted data from an external website.
  • Ingestion points: Data is retrieved from the NIST WebBook via HTTP GET requests in scripts/query_spectra.py.
  • Boundary markers: None; the script saves the raw response body directly to the local file system.
  • Capability inventory: The script has the ability to create directories (os.makedirs) and write files (open().write()) on the agent's host system.
  • Sanitization: No validation or sanitization of the downloaded JCAMP-DX formatted content is performed prior to saving.
  • [COMMAND_EXECUTION]: The script scripts/query_spectra.py contains a critical logic error at the end of the main() function. It attempts to import a missing local module (src.utils.config_utils) and references undefined variables (_params_path, _config), which will result in a NameError or ImportError at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 04:47 PM