plink2-gwas-analysis

Warn

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill downloads a pre-compiled binary from an external Amazon S3 bucket and immediately grants it executable permissions before running it.
  • Evidence: wget https://s3.amazonaws.com/plink2-assets/alpha6/plink2_linux_avx2_20241112.zip, unzip plink2_linux_avx2_20241112.zip, chmod +x plink2 followed by plink2 --version.
  • [EXTERNAL_DOWNLOADS]: The skill fetches a binary archive and multiple Python dependencies from remote sources during the installation phase.
  • Evidence: Downloads from s3.amazonaws.com and installation of pandas, numpy, matplotlib, and scipy via pip.
  • [PRIVILEGE_ESCALATION]: The installation process modifies file permissions to enable execution of a downloaded binary.
  • Evidence: chmod +x plink2 applied to the downloaded PLINK2 binary.
  • [COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage the tool lifecycle and process genomic data.
  • Evidence: Usage of wget, unzip, chmod, export, plink2, head, wc, and ls.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external genomic and metadata files which could be manipulated to influence the agent's behavior.
  • Ingestion points: Reads genotype data from VCF, BGEN, and PLINK binary files (.bed, .bim, .fam), alongside user-provided phenotype and covariate text files.
  • Boundary markers: None. The skill does not implement delimiters or instructions to ignore potential commands embedded within data files.
  • Capability inventory: Includes the ability to execute the plink2 binary, run Python code, and perform network requests (via wget).
  • Sanitization: None. The skill does not validate or sanitize the content of the genomic or metadata files before processing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 14, 2026, 03:50 AM