phylogenetics

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to call external bioinformatics software including MAFFT, IQ-TREE 2, and FastTree. All commands are constructed using argument lists without the shell (shell=False), which is a recommended security practice to prevent command injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill references installing scientific packages from trusted repositories like Bioconda and PyPI. No scripts or binaries are downloaded from unverified or arbitrary remote URLs.\n- [PROMPT_INJECTION]: The skill features a data ingestion surface where FASTA files are read in scripts/phylogenetic_analysis.py. While no specific boundary markers or sanitization of sequence headers are present, the potential risk for indirect prompt injection is mitigated by the use of structured argument lists in all downstream subprocess calls. The capability inventory includes local file writes and execution of specific bioinformatics binaries.\n- [DATA_EXFILTRATION]: No network operations or unauthorized access to sensitive files (such as credentials or SSH keys) were identified. The skill's operations are confined to the local processing of biological sequence data.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 08:21 AM
Security Audit — agent-trust-hub — phylogenetics