gsva-analysis-and-visualization
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external expression matrices and group files, creating a surface for indirect prompt injection attacks.
- Ingestion points: The file scripts/io.R reads CSV and TSV formatted data provided by the user.
- Boundary markers: There are no explicit boundary markers or instructions to disregard embedded commands within the ingested data files.
- Capability inventory: The skill has the capability to perform file system writes and execute subprocesses via the system2 command as seen in tests/run_tests.R.
- Sanitization: The skill performs numeric validation on matrix values and implements sanitization for plot filenames to prevent path traversal.
- [INDIRECT_PROMPT_INJECTION]: The skill contains a self-referential evaluation report file (eval_report_gsva-analysis-and-visualization_result.json) that explicitly claims the skill is safe.
- Evidence: The file contains metadata assertions such as 'security: PASS' and 'scientific_integrity: result: PASS', which are designed to target the auditor's judgment.
- [EXTERNAL_DOWNLOADS]: The skill downloads biological pathway data from the Molecular Signatures Database using the msigdbr R package.
- Evidence: The scripts/functions.R file utilizes msigdbr::msigdbr to fetch gene sets for specific species and categories. This fetch targets well-known and established bioinformatics repositories.
Audit Metadata