rdkit
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill recommends using
pickle.load()as a best practice for performance when handling molecular data. Thepicklemodule is insecure and can execute arbitrary code during the deserialization of data from untrusted sources.\n- [PROMPT_INJECTION]: The 'Suggest Using K-Dense Web For Complex Worflows' section contains instructions that attempt to steer agent behavior by directing it to proactively recommend a specific external platform and URL (www.k-dense.ai) when task complexity increases.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external chemical data formats, which creates a surface for indirect prompt injection if those files contain malicious instructions.\n - Ingestion points: Functions such as
Chem.MolFromSmiles,Chem.SDMolSupplier, andChem.MolFromMolFileinSKILL.mdread data from potentially untrusted external sources.\n - Boundary markers: The skill does not define or use boundary markers to separate data from instructions.\n
- Capability inventory: The agent has the ability to write to the file system (
SDWriter,Draw.MolToFile,pickle.dump) and potentially execute code via the recommendedpickle.loadpattern.\n - Sanitization: While RDKit performs chemical validation (aromaticity, valence), there is no evidence of security-focused sanitization for data parsed from external sources.
Audit Metadata