fda-drug-information

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill's primary function is to provide read-only access to public regulatory data from official sources.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from api.fda.gov. This is the official and well-known API endpoint for the U.S. Food and Drug Administration.
  • [COMMAND_EXECUTION]: The skill utilizes standard system HTTP clients, specifically curl and fetch, to perform network requests to the FDA API.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes data retrieved from an external API.
  • Ingestion points: Untrusted data enters the agent context via the api.fda.gov endpoint as described in SKILL.md.
  • Boundary markers: There are no explicit boundary markers or instructions to ignore embedded content in the provided documentation.
  • Capability inventory: The skill relies on curl and fetch for its primary network operations.
  • Sanitization: No specific sanitization or validation logic for the external API response is identified in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 01:03 PM
Security Audit — agent-trust-hub — fda-drug-information