tooluniverse-metabolomics
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external metabolomics databases including HMDB, MetaboLights, and PubChem. Processing untrusted data from these external APIs creates an attack surface for indirect prompt injection.
- Ingestion points: Metabolite annotations, study descriptions, and search results fetched from external repositories (SKILL.md).
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded in the retrieved data.
- Capability inventory: The skill has the ability to write files to the local system and execute further network requests based on data retrieved.
- Sanitization: There is no mention of sanitization or validation for the external content before it is processed or written to reports.
- [EXTERNAL_DOWNLOADS]: The skill communicates with well-known and established scientific repositories to fetch data. These include the Human Metabolome Database (HMDB), MetaboLights, the NIH Metabolomics Workbench, and PubChem. These connections are standard for the skill's documented research purpose.
Audit Metadata