bio-splicing-quantification

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The examples/quantify_splicing.py script uses subprocess.run to execute external bioinformatics CLI tools like suppa.py. The script follows security best practices by passing arguments as a list rather than a shell string, mitigating common command injection risks.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection as it is designed to ingest and process biological data files such as GTF, BAM, and TPM files.
  • Ingestion points: The example script reads data from external files using pd.read_csv in the filter_reliable_events and parse_rmats_output functions.
  • Boundary markers: No specific delimiters or safety instructions are used to separate biological data from agent instructions, though this is typical for research software.
  • Capability inventory: The skill possesses the capability to read files from the filesystem and execute system commands via the subprocess module.
  • Sanitization: The provided examples do not implement sanitization or validation of the internal content of processed data files.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing dependencies from well-known bioinformatics sources and official repositories.
  • Evidence: The usage-guide.md documentation includes commands for installing software via pip (PyPI), conda (Bioconda), and devtools (GitHub).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 12:04 PM