nextflow

Fail

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill includes the standard installation command for the Nextflow engine using curl -s https://get.nextflow.io | bash in SKILL.md. This is the official installation method for a well-known scientific workflow platform.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of nf-core via uv pip and nextflow via conda from the bioconda and conda-forge channels. It also describes mechanisms for downloading remote pipelines from GitHub using nextflow pull and nextflow run <user/repo>.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external and untrusted data, which presents a surface for indirect prompt injection.
  • Ingestion points: The agent is instructed to run and develop Nextflow pipelines that ingest data from .nf scripts, nextflow.config files, and CSV samplesheets (described in SKILL.md and references/running-pipelines.md).
  • Boundary markers: There are no explicit instructions for the agent to treat input files with specific delimiters or to ignore potential instructions embedded within data files.
  • Capability inventory: The skill provides the ability to execute shell scripts through the nextflow runtime and perform network operations to fetch remote assets.
  • Sanitization: The skill relies on the inherent isolation provided by the Nextflow runtime, such as per-task work directories and containerization (Docker/Singularity).
Recommendations
  • HIGH: Downloads and executes remote code from: https://get.nextflow.io - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 11, 2026, 06:51 AM
Security Audit — agent-trust-hub — nextflow