phylogenetics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external bioinformatics command-line tools including MAFFT, IQ-TREE 2, and FastTree using the
subprocessmodule. - Evidence: Functions in
scripts/phylogenetic_analysis.pyandSKILL.md(e.g.,run_mafft,run_iqtree) usesubprocess.runwith list-based arguments. - This implementation is safe as it avoids the use of
shell=True, effectively preventing command injection vulnerabilities from untrusted file names or parameters. - [EXTERNAL_DOWNLOADS]: The skill references the installation of scientific software from well-known community repositories.
- Evidence: Installation instructions point to
biocondaformafft,iqtree, andfasttree, and to the Python Package Index (PyPI) forete3andPyQt5. - These are trusted sources within the biological research community.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests biological sequence data from external FASTA files.
- Evidence: The script reads FASTA files to count sequences and passes file paths to analysis tools.
- The attack surface is minimal as the ingestion logic only counts lines starting with standard FASTA headers (
>) and does not process the content as instructions.
Audit Metadata