tooluniverse-chemical-compound-retrieval
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing a local Python script (
src/tooluniverse/tools/smiles_verifier.py) using external chemical strings as arguments, which could be exploited if input is not properly sanitized. - [INDIRECT_PROMPT_INJECTION]: The skill ingests chemical metadata, synonyms, and properties from external APIs (PubChem, ChEMBL, FDA) without explicit boundary markers or sanitization, potentially allowing malicious content within these databases to influence agent behavior.
- [DYNAMIC_EXECUTION]: The skill performs runtime execution of internal Python tools to verify chemical structures provided by users or retrieved from databases.
- [EXTERNAL_DOWNLOADS]: The skill fetches data and molecular properties from well-known and trusted scientific services, including PubChem (NLM/NIH), ChEMBL (EMBL-EBI), and the FDA.
Audit Metadata