lamindb
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes legitimate CLI tools for environment setup and data management, including
uv pip installfor package management andlamin init/lamin migratefor database administration. These commands are standard for the tool's scientific purpose.\n- [EXTERNAL_DOWNLOADS]: The skill instructions involve fetching biological ontology data from established public repositories via Bionty and citation information from ArXiv. These are well-known scientific services necessary for the skill's primary function.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external biological data (DataFrames, AnnData). Ingestion points:Artifact.load()andDataFrameCurator(SKILL.md); Boundary markers: Implemented vialn.Schemadefinitions (references/annotation-validation.md); Capability inventory: Includes file writes, network operations to S3/GCS, and CLI execution; Sanitization: Provided bycurator.validate(), which raisesValidationErroron failure. The instructions emphasize structural validation before data registration.\n- [CREDENTIALS_UNSAFE]: The skill promotes secure credential management by instructing users to use workload identities or environment variables (e.g.,LAMIN_API_KEY,LAMIN_DB_URL) for authentication with remote databases and cloud storage, rather than hardcoding sensitive secrets.
Audit Metadata