gget
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill integrates the 'gget' bioinformatics package, an established tool published in scientific journals for genomic data retrieval.
- [EXTERNAL_DOWNLOADS]: The skill documents the 'gget setup' functionality which downloads required model parameters and scientific databases. This includes AlphaFold2 parameters (approx. 4GB), the Eukaryotic Linear Motif (ELM) database, and 'cellxgene-census' dependencies.
- [COMMAND_EXECUTION]: The skill uses the 'Bash' tool to execute 'gget' commands and 'curl' for downloading reference genomes. These are standard operations for the tool's intended bioinformatics use-case.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted scientific data (FASTA sequences and gene lists) and interacts with LLMs via 'gget gpt'. While this creates an attack surface for indirect prompt injection, it is the primary intended purpose of the tool, and the documentation includes best practices for credential safety (e.g., using environment variables instead of hardcoded keys).
- [CREDENTIALS_SAFE]: The documentation explicitly warns against hardcoding API keys for OpenAI and COSMIC, recommending the use of environment variables and interactive prompts to maintain security.
Audit Metadata