busco-phylogeny
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads several established bioinformatics tools, including Aliscore, ALICUT, and FASconCAT-G, from GitHub repositories owned by the skill author (brunoasm) and the original software developer (PatrickKueck). These are legitimate scientific tools required for the workflow.
- [COMMAND_EXECUTION]: The skill utilizes Python's subprocess module in scripts such as query_ncbi_assemblies.py and download_ncbi_genomes.py to interface with the official NCBI datasets CLI. This is standard behavior for downloading and querying genomic data. It also generates and executes shell scripts to manage the analysis pipeline across local and cluster environments (SLURM/PBS).
- [REMOTE_CODE_EXECUTION]: The workflow involves downloading Perl scripts and running them locally. These scripts are necessary components of the advertised pipeline for alignment trimming and sequence concatenation. The use of these external scripts is clearly documented and matches the skill's primary scientific purpose.
- [DATA_EXFILTRATION]: Network operations are restricted to fetching scientific documentation (IQ-TREE), genomic data (NCBI), and necessary software tools from GitHub. No attempts to access sensitive local files or transmit user data to unknown external servers were identified.
- [PROMPT_INJECTION]: The skill was evaluated for both direct and indirect injection vectors. It ingests metadata from NCBI and documentation via WebFetch. The scripts include basic sanitization for sample naming to prevent path traversal or shell injection. No instructions attempting to override agent safety constraints or extract system prompts were detected.
Audit Metadata