etetoolkit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
NCBITaxacomponent from the ETE toolkit, which fetches the NCBI taxonomy database (approximately 300MB) from official NCBI servers to a local directory at~/.etetoolkit/taxa.sqlitefor local caching and analysis.- [COMMAND_EXECUTION]: The skill includes Python scripts (scripts/tree_operations.pyandscripts/quick_visualize.py) designed to perform file-based operations, such as reading Newick tree files, performing topological modifications, and rendering outputs to PNG, PDF, or SVG formats.- [INDIRECT_PROMPT_INJECTION]: The skill processes external biological data formats (Newick, NHX, FASTA), establishing an attack surface for data-driven instructions. - Ingestion points: External files are loaded via the
Tree(),PhyloTree(), andClusterTree()constructors within the provided scripts and examples. - Boundary markers: Not present; processing relies on the
ete3library's standard parsing logic. - Capability inventory: The skill can write files to the local system (
tree.write,tree.render), perform network updates for taxonomy data (ncbi.update_taxonomy_database), and launch a GUI for visualization (tree.show). - Sanitization: Data is parsed according to standard bioinformatics format specifications by the underlying
ete3library.- [PRIVILEGE_ESCALATION]: The documentation inSKILL.mdsuggests usingsudo apt-getfor the installation of system-level PyQt5 dependencies required for the toolkit's graphical rendering features.
Audit Metadata