etetoolkit

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the NCBITaxa component from the ETE toolkit, which fetches the NCBI taxonomy database (approximately 300MB) from official NCBI servers to a local directory at ~/.etetoolkit/taxa.sqlite for local caching and analysis.- [COMMAND_EXECUTION]: The skill includes Python scripts (scripts/tree_operations.py and scripts/quick_visualize.py) designed to perform file-based operations, such as reading Newick tree files, performing topological modifications, and rendering outputs to PNG, PDF, or SVG formats.- [INDIRECT_PROMPT_INJECTION]: The skill processes external biological data formats (Newick, NHX, FASTA), establishing an attack surface for data-driven instructions.
  • Ingestion points: External files are loaded via the Tree(), PhyloTree(), and ClusterTree() constructors within the provided scripts and examples.
  • Boundary markers: Not present; processing relies on the ete3 library's standard parsing logic.
  • Capability inventory: The skill can write files to the local system (tree.write, tree.render), perform network updates for taxonomy data (ncbi.update_taxonomy_database), and launch a GUI for visualization (tree.show).
  • Sanitization: Data is parsed according to standard bioinformatics format specifications by the underlying ete3 library.- [PRIVILEGE_ESCALATION]: The documentation in SKILL.md suggests using sudo apt-get for the installation of system-level PyQt5 dependencies required for the toolkit's graphical rendering features.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:40 PM