multiqc-qc-reports
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for installing and running several command-line utilities, including
multiqc,fastqc,samtools,STAR,pip, andconda. These are standard tools within the bioinformatics domain. - [DYNAMIC_EXECUTION]: The skill contains a Python example that uses a shell heredoc (`python3
- << 'EOF'`) to execute a script defined within the markdown. This script is intended to parse JSON data produced by MultiQC.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external bioinformatics tools (such as log files and statistics summaries) to generate interactive reports, creating a potential surface for indirect prompt injection if the input files are sourced from an untrusted environment.
- Ingestion points: The skill recursively scans local directories for output files from over 150 different bioinformatics tools, as described in SKILL.md.
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat the ingested log data as untrusted or to ignore embedded instructions.
- Capability inventory: The skill has capabilities for file system operations (reading logs, writing HTML reports), package management (pip/conda), and executing local Python scripts (SKILL.md).
- Sanitization: No explicit validation or sanitization steps are documented for the input log files prior to processing.
Audit Metadata