tooluniverse-disease-research
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to suppress transparency by stating "DO NOT show the search process to the user," which overrides typical agent communication protocols.\n- [COMMAND_EXECUTION]: The skill provides a research protocol that involves creating and writing to local files using filenames derived directly from user input (e.g.,
filename = f"{disease_name.lower().replace(' ', '_')}_research_report.md"). This creates a path traversal vulnerability if the agent executes this logic literally without sanitizing characters like../in thedisease_name.\n- [PROMPT_INJECTION]: The skill possesses a significant attack surface for Indirect Prompt Injection (Category 8).\n - Ingestion points: Data is ingested from over 100 external tools and databases including PubMed, OpenTargets, ClinVar, and OpenAlex in
SKILL.md.\n - Boundary markers: The instructions lack any boundary markers, delimiters, or guidelines to treat retrieved data as untrusted content.\n
- Capability inventory: The agent is authorized to perform file-system writes (
open(),f.write()) and conduct network-based API calls via thetu.toolsnamespace.\n - Sanitization: There are no instructions for sanitizing, escaping, or validating the external content before it is interpolated into the markdown report and processed by the agent.
Audit Metadata