cnvkit-copy-number
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands and the
subprocess.runPython function to executecnvkit.pyand other bioinformatics utilities likesamtoolsandRscript. These operations are consistent with the skill's stated purpose of automating genomic analysis pipelines. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install software and dependencies from official, well-known registries including PyPI (
pip install cnvkit), Bioconda (conda install -c bioconda cnvkit), and Bioconductor (BiocManager::install("DNAcopy")). These sources are recognized as safe environments for package distribution. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it ingests and processes untrusted external genomic data.
- Ingestion points: Processes user-provided BAM, BED, and FASTA files, as well as intermediate CNVkit data files (CNN, CNR, CNS) as described in Steps 2-8.
- Boundary markers: No specific boundary markers or instruction-ignoring delimiters are employed when processing or outputting data from these files.
- Capability inventory: The skill possesses the ability to execute shell commands via
subprocess.runand perform file system operations through thecnvlibandpandaslibraries. - Sanitization: No explicit sanitization or validation of the content within the genomic data files is documented before it is processed by the analysis tools.
Audit Metadata