tracking-taxonomy-updates
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides instructions for downloading authoritative taxonomy data from established scientific sources, including the NCBI FTP server (taxdump) and the GTDB portal. These are well-known scientific repositories and the downloads are for standard reference data for scientific analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill processes sequence metadata from
quickclade.tsvwhich is then used by the agent to determine the domain-routing workflow and generate reports. This ingestion of external data creates a surface where malicious content could attempt to influence the agent's instructions or subsequent outputs. Evidence: Ingestion point isquickclade.tsv(processed byscripts/quickclade_to_routing.py); boundary markers are absent; capabilities include tool execution viasbatchand report generation; sanitization is limited to basic string manipulation. - [COMMAND_EXECUTION]: The skill uses
sbatchto submit jobs to a SLURM scheduler anddocker/apptainerto run containers for bioinformatics analysis. These tools are used for their intended scientific purpose, and the execution scripts inscripts/submit_taxonomy.shinclude validation for tool names and use absolute paths to mitigate command injection risks during standard operations.
Audit Metadata