The Agent Skills Directory

[SAFE]: The skill's primary function is to parse VCF (Variant Call Format) files, classify mutations, and annotate them using established bioinformatics databases. No indicators of prompt injection, data exfiltration, or persistence were found.
[EXTERNAL_DOWNLOADS]: The documentation recommends installing standard, well-known bioinformatics libraries such as cyvcf2, pysam, and pandas. It also references the tooluniverse package, which is part of the vendor's ecosystem for querying clinical and population databases.
[REMOTE_CODE_EXECUTION]: The implementation is written in pure Python and integrates with a provided tooluniverse framework. It does not use eval, exec, or subprocess to execute unverified code. All logic is contained within the provided scripts and standard libraries.
[DATA_EXFILTRATION]: The skill makes network requests to well-known bioinformatics services including MyVariant.info, dbSNP (NIH), gnomAD (Broad Institute), and Ensembl. These operations are essential for the skill's stated purpose of variant annotation and use official public APIs.
[PROMPT_INJECTION]: No evidence of prompt injection attempts or instructions to bypass safety guidelines were found in the SKILL.md, README.md, or implementation files.
[CREDENTIALS_UNSAFE]: The .env.template file correctly uses placeholders for API keys, encouraging standard security practices for secret management by the user.
[INDIRECT_PROMPT_INJECTION]: While the skill processes untrusted VCF data provided by users (Category 8), the risk is mitigated by strong data typing (converting values to float/int) and mapping input strings against a predefined whitelist of mutation types (CONSEQUENCE_TO_MUTATION_TYPE).

tooluniverse-variant-analysis