ncbi-clinicaltables-skill

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [File System Interaction]: The script scripts/ncbi_gene_clinicaltables.py can write API responses to a local path defined by the raw_output_path parameter. This is used when save_raw is enabled to manage large datasets. While functional, it is important to ensure the agent uses designated directories for these files.
  • [Network Operations]: The skill connects to clinicaltables.nlm.nih.gov to retrieve gene data. This is a well-known service provided by the National Library of Medicine and is consistent with the skill's stated purpose.
  • [Data Processing Surface]: The skill incorporates gene data from an external API into the agent's context, which is a potential surface for indirect prompt injection.
  • Ingestion points: External data is fetched in scripts/ncbi_gene_clinicaltables.py via HTTP GET requests.
  • Boundary markers: The skill does not explicitly use delimiters for the fetched data.
  • Capability inventory: The skill has the ability to write files to the local disk via the Path.write_text method.
  • Sanitization: Results are processed through a _compact function that truncates long strings and limits the number of items returned to the agent, providing a degree of structural validation and output management.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 12:20 PM
Security Audit — agent-trust-hub — ncbi-clinicaltables-skill