deeptools
Warn
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/workflow_generator.pyscript generates bash scripts by interpolating user-provided parameters (such as--input-bamand--chip-bams) directly into shell command templates via f-strings. This process lacks sanitization or escaping, which allows for shell command injection if an attacker provides malicious strings. - [COMMAND_EXECUTION]: The instructions in
SKILL.mdguide the agent or user to grant execution permissions to these dynamically generated files usingchmod +xand then execute them, facilitating the execution of potentially injected code. - [EXTERNAL_DOWNLOADS]: The skill directs the installation of the
deeptoolslibrary from a public package registry, which is a standard tool for this domain of bioinformatics analysis.
Audit Metadata