scvi-tools

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill demonstrates the use of the host.compute API to execute Python scripts (e.g., pipeline.py) on remote compute instances. This is a standard platform feature utilized to offload large-scale genomic data processing to specialized hardware.
  • [DATA_EXFILTRATION]: The remote compute workflow involves transferring local datasets (.h5ad files) to an external compute provider (byoc:modal). This transmission is a necessary component of the skill's primary function to facilitate high-performance analysis on remote infrastructure.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface through the ingestion of AnnData files.
  • Ingestion points: The agent is instructed to read external files via sc.read_h5ad("dataset.h5ad") in SKILL.md.
  • Boundary markers: No explicit delimiters or boundary markers are used to separate untrusted data in the file's metadata from the agent's instructional context.
  • Capability inventory: The skill allows remote script execution via host.compute.submit_job and local file creation/modification via .write_h5ad().
  • Sanitization: The provided instructions and helper scripts do not include sanitization or validation logic for data read from the .h5ad metadata fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 01:22 AM
Security Audit — agent-trust-hub — scvi-tools