etetoolkit
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads taxonomy data from the National Center for Biotechnology Information (NCBI) and the official etetoolkit GitHub repository. These are well-known scientific and vendor resources.
- [INDIRECT_PROMPT_INJECTION]: The skill processes Newick and Nexus tree files, as well as TSV metadata files. This constitutes a data ingestion surface where external content is parsed and incorporated into the agent's context. The skill includes validation steps and uses structured parsers to mitigate risks.
- [DYNAMIC_EXECUTION]: The ETE 4 library includes a TreePattern feature that supports embedded Python expressions for matching. The skill's documentation explicitly warns against using untrusted input for these patterns and recommends using safer topology-only matching or standard traversal predicates instead.
Audit Metadata