tooluniverse-disease-research
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes data from numerous external sources without sanitization.\n
- Ingestion points: Data enters the agent context via over 100 research tools documented in
TOOLS_REFERENCE.mdandtool_usage_details.md, includingPubMed_search_articles,europe_pmc_search_abstracts, andOpenTargets_get_publications_by_disease_efoId.\n - Boundary markers: The report template in
REPORT_TEMPLATE.mdand the update logic inRESEARCH_PROTOCOL.mddo not utilize delimiters (e.g., XML tags) or specific instructions to the agent to disregard potential commands hidden within retrieved medical abstracts or database entries.\n - Capability inventory: Across its scripts, the skill utilizes file system write capabilities (
open(filename, 'w')) and extensive network read operations through provided API tools.\n - Sanitization: The research protocol in
RESEARCH_PROTOCOL.mdlacks content validation or escaping of retrieved content before it is interpolated into the markdown report.\n- [COMMAND_EXECUTION]: The skill provides functional Python code templates inRESEARCH_PROTOCOL.mdfor file creation and data updates. It directs the agent inSKILL.mdto follow these 'step-by-step code procedures,' which involves generating and executing local scripts to manage the research report workflow.
Audit Metadata