pubchem-database
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The scripts interact with the external domain pubchem.ncbi.nlm.nih.gov to retrieve bioactivity and compound data. While this is a trusted scientific resource, it is an external dependency.
- [PROMPT_INJECTION] (LOW): The skill creates an indirect prompt injection surface as it processes community-contributed data from PubChem. (1) Ingestion points: scripts/bioactivity_query.py and scripts/compound_search.py fetch data from the PubChem REST API and PUG-View. (2) Boundary markers: Absent; data is returned as raw dictionaries or objects without delimiters. (3) Capability inventory: scripts/compound_search.py contains a download_structure function that uses pcp.download to write files to the local disk with overwrite=True. (4) Sanitization: Absent; the skill does not validate or sanitize the strings returned by the external API before presenting them or using them in file operations.
Audit Metadata