tooluniverse-gene-enrichment
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/enrichgo_runner.pyutilizessubprocess.runto execute an R script dynamically generated from a template. This execution is necessary to perform Gene Ontology analysis using theclusterProfilerR package, which is a standard requirement for the skill's stated scientific purpose. - [EXTERNAL_DOWNLOADS]: The skill documentation describes the installation of R package dependencies and relies on the
gseapyPython library, which fetches genomic pathway data from the Enrichr API. These network operations are functional requirements for pathway enrichment analysis. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes untrusted user-supplied data. Ingestion points: Data enters through gene list files, background universe files, and pre-existing scientific notebooks. Boundary markers: The instructions emphasize using pre-computed results and specific thresholds to minimize interpretation variance but do not define explicit delimiters for raw gene list data. Capability inventory: The skill possesses the ability to execute shell commands (via Rscript) and write to the local file system (specifically the
/tmpdirectory). Sanitization: The scripts perform standard data cleanup, such as stripping headers, normalizing whitespace, and removing version suffixes from Ensembl IDs.
Audit Metadata