folklore-variant-evidence
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill implements proactive data protection by explicitly instructing the agent to remove or refuse patient names, case identifiers, phenotypes, and other private context before making tool calls. This effectively mitigates the risk of accidental PII leakage to the remote endpoint.
- [EXTERNAL_DOWNLOADS]: The skill connects to a hosted MCP endpoint at
https://api.helena.bio/folklore/v1/mcp. This is a documented life-sciences service provided by Helena Bioinformatics (Kalaris Labs). The communication is conducted over standard HTTPS and uses public JSON-RPC calls. - [COMMAND_EXECUTION]: A
curlexample is provided in the documentation to demonstrate how to interact with the API manually. The command is static, follows best practices (timeouts, error handling), and does not incorporate unsanitized user input. - [INDIRECT_PROMPT_INJECTION]: While the skill processes external scientific data (variant evidence and literature), it defines strict boundary markers and instructs the agent to separate returned facts from its own synthesis. It also mandates that the agent report exactly what is returned without reinterpreting failure states as scientific evidence.
Audit Metadata