zinc-database
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates data retrieval from well-known academic domains docking.org and cartblanche22.docking.org, which are maintained by the University of California, San Francisco. These are trusted sources for scientific data.
- [COMMAND_EXECUTION]: The documentation provides examples for using curl, wget, and aria2c. Python templates demonstrate the use of subprocess.run with argument lists to fetch data safely.
- [METADATA_POISONING]: The skill metadata lists the author as 'K-Dense Inc.', which differs from the platform-provided author name 'MarieLynneBlock'. This is a minor inconsistency with no identified security impact.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API (CartBlanche22), constituting an indirect prompt injection surface. Ingestion points: cartblanche22.docking.org/substances.txt and /smiles.txt. Boundary markers: Absent. Capability inventory: Use of curl and subprocess.run to process returned SMILES and ZINC IDs. Sanitization: Absent in the provided Python templates. Given the reputable source and data structure, the risk is negligible.
Audit Metadata