phylogenetics

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes external bioinformatics command-line tools including MAFFT, IQ-TREE 2, and FastTree using the subprocess module.
  • Evidence: Functions in scripts/phylogenetic_analysis.py and SKILL.md (e.g., run_mafft, run_iqtree) use subprocess.run with list-based arguments.
  • This implementation is safe as it avoids the use of shell=True, effectively preventing command injection vulnerabilities from untrusted file names or parameters.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of scientific software from well-known community repositories.
  • Evidence: Installation instructions point to bioconda for mafft, iqtree, and fasttree, and to the Python Package Index (PyPI) for ete3 and PyQt5.
  • These are trusted sources within the biological research community.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests biological sequence data from external FASTA files.
  • Evidence: The script reads FASTA files to count sequences and passes file paths to analysis tools.
  • The attack surface is minimal as the ingestion logic only counts lines starting with standard FASTA headers (>) and does not process the content as instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:50 PM
Security Audit — agent-trust-hub — phylogenetics