pysam
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external genomic data files (SAM, BAM, CRAM, VCF, BCF, FASTA, FASTQ) which constitutes an attack surface for indirect prompt injection.
- Ingestion points: Bundled scripts such as
scripts/inspect_hts.py,scripts/alignment_qc.py,scripts/variant_summary.py, andscripts/filter_alignments.pyingest user-provided data files. - Boundary markers: The skill provides extensive documentation on expected data schemas and coordinate systems to guide the agent's interpretation.
- Capability inventory: The skill can execute shell commands via
pysam.samtoolsandpysam.bcftoolsand perform file writing operations. - Sanitization: Data is parsed using the
pysamlibrary, which relies on the mature and widely-used HTSlib C library for robust parsing. - [COMMAND_EXECUTION]: The skill uses
pysam.samtoolsandpysam.bcftoolsto dispatch shell commands for genomic file processing (e.g., sorting, indexing, and merging). The instructions explicitly warn against composing dispatcher arguments from untrusted shell commands to prevent injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill references several external resources, including citation metadata from arXiv (
arxiv.org) and developer documentation from PyPI (pypi.org), GitHub (github.com), and Read the Docs (readthedocs.io). These references target well-known scientific and developer services and are used for documentation and attribution purposes.
Audit Metadata