alterlab-cbioportal
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions for downloading large cancer genomics datasets directly from the cBioPortal S3 data hub. This is a legitimate and standard mechanism for academic data distribution.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external cBioPortal API endpoints, representing a potential surface for indirect prompt injection where instructions embedded in scientific data could influence the agent.
- Ingestion points: Genomics and clinical data are retrieved via API calls in scripts/query_cbioportal.py and described in SKILL.md.
- Boundary markers: Absent; data is returned to the agent without specific delimiters or isolation instructions.
- Capability inventory: The skill is configured to use network access and Python script execution to facilitate data retrieval and processing.
- Sanitization: The skill performs standard JSON parsing but does not specifically filter retrieved data for potential prompt injection patterns.
Audit Metadata