ncbi-datasets-skill
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [External Service Interaction]: The skill fetches genomic and taxonomic metadata from the NCBI Datasets API (
api.ncbi.nlm.nih.gov). This is a well-known scientific resource, and the script hardcodes the base URL to ensure requests are directed to the legitimate service. - [Local File Writing]: The script includes functionality to save raw API responses to the local file system. While the default behavior uses
/tmp, it allows specifying araw_output_path. This capability for file creation and modification should be monitored in secure environments. - [Indirect Prompt Injection Surface]: As the skill ingests data from an external scientific database, it is subject to indirect prompt injection considerations. The script implements basic mitigation via string truncation (
_compactfunction) and structured data parsing, which reduces the risk of the agent misinterpreting external data as instructions.
Audit Metadata