drug-discovery-search
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network POST requests to
https://api.valyu.ai/v1/search. While this is the intended primary function for drug discovery queries, it targets a domain not included in the standard whitelist. No sensitive local file data is accessed or transmitted during this process. - [INDIRECT_PROMPT_INJECTION]: The skill ingests results from an external API, which could potentially contain instructions aimed at influencing the agent's behavior.
- Ingestion points: The
searchfunction inscripts/search.mjsfetches data from theapi.valyu.aiendpoint and returns it to the agent. - Boundary markers: The skill does not implement specific boundary delimiters or instructions to ignore embedded commands within the fetched drug data.
- Capability inventory: The skill has the ability to execute local scripts and write configuration data to the user's home directory (
~/.valyu/config.json). - Sanitization: Results returned from the search (including compound titles and content) are passed to the agent without sanitization or filtering.
Audit Metadata