alterlab-cosmic
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of genomic datasets from the official COSMIC repository at
cancer.sanger.ac.uk. These downloads originate from a well-known scientific research organization and are standard for the tool's scientific purpose.- [CREDENTIALS_UNSAFE]: The skill requires a COSMIC account and handles user credentials (email and password) to perform authenticated API calls. It correctly implements HTTP Basic Auth to the official Sanger Institute domain and provides a CLI utility that supports secure password entry.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large external scientific data files, which presents a surface for indirect prompt injection. * Ingestion points: External mutation data files (TSV, CSV, VCF formats) downloaded via the COSMIC API (e.g.,CosmicMutantExport.tsv.gz). * Boundary markers: No explicit delimiter or instruction-guarding boundaries are defined for the contents of the genomic data files. * Capability inventory: Includes file system writes (saving datasets), network access (API requests), and execution of local Python scripts for data filtering and analysis. * Sanitization: The skill relies on standard bioinformatic libraries such aspandasandpysamto parse the structured genomic data, providing inherent structural validation.- [COMMAND_EXECUTION]: The skill utilizes Python automation and shell commands (curl) to manage the retrieval and transformation of cancer genomic data, which is an expected behavior for its stated bioinformatics workflow.
Audit Metadata