alterlab-blast
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing external sequence databases and search result files without comprehensive sanitization of string identifiers.
- Ingestion points: The
scripts/parse_blast_tab.pyscript reads and parses sequence search results from user-supplied local files. - Boundary markers: The skill does not implement specific delimiters or explicit instructions to the agent to treat search result content as untrusted data during the parsing workflow.
- Capability inventory: The skill is authorized to use
Bashfor command execution (restricted to sequence search tools) andRead/Writetools for file management. - Sanitization: While the parsing script coerces numeric metrics (e-values, bitscores) to float types for filtering, it does not sanitize sequence IDs or descriptions before they are returned to the agent context.
- [EXTERNAL_DOWNLOADS]: The skill references and relies on binaries and documentation from well-known bioinformatics organizations and repositories.
- Fetches documentation and provides command references for NCBI BLAST+ tools.
- References the official DIAMOND sequence aligner from its public GitHub repository.
- Notes compatibility and installation via the Bioconda package registry.
Audit Metadata