dnanexus-integration
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official
dxpyPython SDK viapipand system-level bioinformatics packages throughapt-getand Docker registries (e.g., pullingbiocontainers/samtools). These resources are sourced from reputable and well-known providers in the genomics and technology sectors. - [COMMAND_EXECUTION]: Multiple components of the skill, specifically in
references/app-development.mdandreferences/configuration.md, demonstrate the use ofsubprocess.check_callto run external bioinformatics software. This capability is required for the platform's intended analytical workflows. - [REMOTE_CODE_EXECUTION]: The skill provides instructions for packaging local code into applets and deploying them to remote DNAnexus workers for execution. This is a core feature of the platform and is documented neutrally as a standard operational procedure.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest external genomics data which is then used as input for shell-based bioinformatics tools.
- Ingestion points: Data is brought into the environment via
dxpy.download_dxfileand file contents are read using theDXFile.open_filemethod inreferences/data-operations.md. - Boundary markers: The provided instructions and examples do not include delimiters or specific warnings to the agent regarding potential instructions embedded within the processed data objects.
- Capability inventory: The environment allows for significant command execution via
subprocessand the launching of cloud-based jobs using thedxpy.DXApplet.runmethod. - Sanitization: There is no evidence of input validation or sanitization of data contents before they are passed to execution handlers in the provided reference materials.
Audit Metadata