alterlab-blast

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing external sequence databases and search result files without comprehensive sanitization of string identifiers.
  • Ingestion points: The scripts/parse_blast_tab.py script reads and parses sequence search results from user-supplied local files.
  • Boundary markers: The skill does not implement specific delimiters or explicit instructions to the agent to treat search result content as untrusted data during the parsing workflow.
  • Capability inventory: The skill is authorized to use Bash for command execution (restricted to sequence search tools) and Read/Write tools for file management.
  • Sanitization: While the parsing script coerces numeric metrics (e-values, bitscores) to float types for filtering, it does not sanitize sequence IDs or descriptions before they are returned to the agent context.
  • [EXTERNAL_DOWNLOADS]: The skill references and relies on binaries and documentation from well-known bioinformatics organizations and repositories.
  • Fetches documentation and provides command references for NCBI BLAST+ tools.
  • References the official DIAMOND sequence aligner from its public GitHub repository.
  • Notes compatibility and installation via the Bioconda package registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 02:36 PM