onekgpd

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the dnaerys Python package (v0.2.1) and communicates with a remote gRPC service at db.dnaerys.org:443 to retrieve genomic and variant data.
  • [COMMAND_EXECUTION]: The skill utilizes uv run to execute its core Python scripts (onekgpd_api.py and onekgpd_meta.py), which triggers automatic dependency resolution and execution of local code.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, which could potentially contain malicious instructions targeting the LLM.
  • Ingestion points: External genotypes and variant annotations are streamed from db.dnaerys.org:443 via onekgpd_api.py. Sample metadata is loaded from the local assets/kgpe.json file via onekgpd_meta.py.
  • Boundary markers: The tool outputs data into structured JSON files and recommends using jq for field extraction, providing a degree of separation between raw data and the agent's prompt context.
  • Capability inventory: The skill has permissions to write Bash commands and execute Python scripts, which are used to process and summarize the fetched data.
  • Sanitization: Results are returned in a structured JSON format; however, the skill does not explicitly sanitize the text content of genomic annotations or metadata fields against prompt injection markers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 03:21 AM