bio-splicing-quantification
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
examples/quantify_splicing.pyscript usessubprocess.runto execute external bioinformatics CLI tools likesuppa.py. The script follows security best practices by passing arguments as a list rather than a shell string, mitigating common command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection as it is designed to ingest and process biological data files such as GTF, BAM, and TPM files.
- Ingestion points: The example script reads data from external files using
pd.read_csvin thefilter_reliable_eventsandparse_rmats_outputfunctions. - Boundary markers: No specific delimiters or safety instructions are used to separate biological data from agent instructions, though this is typical for research software.
- Capability inventory: The skill possesses the capability to read files from the filesystem and execute system commands via the
subprocessmodule. - Sanitization: The provided examples do not implement sanitization or validation of the internal content of processed data files.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing dependencies from well-known bioinformatics sources and official repositories.
- Evidence: The
usage-guide.mddocumentation includes commands for installing software viapip(PyPI),conda(Bioconda), anddevtools(GitHub).
Audit Metadata