dnanexus-integration

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The diagnostic script scripts/inspect_dxpy.py utilizes importlib.import_module() to verify the presence and signatures of specific symbols within the dxpy library. This dynamic loading is used solely for environment verification against the documented baseline and operates on internal constants rather than untrusted external input.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such as DNAnexus project metadata, file paths, and application manifests (dxapp.json).
  • Ingestion points: External data is ingested through the dx CLI and dxpy SDK during project exploration, data search, and manifest validation.
  • Boundary markers: The 'Operating Contract' in SKILL.md provides explicit instructions to the agent to treat all project names, paths, tags, and downloaded content as untrusted data.
  • Capability inventory: The skill has capabilities for file system access, network communication with official DNAnexus endpoints, and execution of cloud-based genomics jobs.
  • Sanitization: The instructions mandate the use of array-based subprocess calls to prevent command injection and provide strong warnings against logging or printing sensitive security contexts.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 04:16 PM