tooluniverse-gwas-trait-to-gene
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external biological databases (GWAS Catalog and Open Targets) which could theoretically contain malicious instructions embedded in metadata fields.\n
- Ingestion points: The
python_implementation.pyscript fetches data usinggwas_get_associations_for_traitandOpenTargets_search_gwas_studies_by_disease. Documentation inSKILL.mdalso provides patterns for usingrequests.getto fetch TSV and JSON data fromebi.ac.uk.\n - Boundary markers: Absent. The skill logic assumes the integrity and structure of the data provided by the external APIs without using delimiters or instructions to ignore embedded content.\n
- Capability inventory: The skill is limited to scientific data aggregation, p-value filtering, and ranking. It does not possess capabilities for file system modification, arbitrary shell execution, or network exfiltration of local sensitive data.\n
- Sanitization: No explicit sanitization or instruction-filtering is applied to the string fields (such as trait descriptions or study metadata) before the data is processed or presented to the agent context.\n- [EXTERNAL_DOWNLOADS]: The skill documentation and implementation scripts reference downloading large biological datasets from established scientific repositories.\n
- Evidence:
SKILL.mdprovides code to download a 37MB TSV dataset from the European Bioinformatics Institute (EBI) athttps://www.ebi.ac.uk/gwas/api/search/downloads/alternativeusingpandasandrequests.\n - Evidence: Implementation scripts interact with Open Targets Genetics and EBI infrastructure via standard API tools.\n- [COMMAND_EXECUTION]: The documentation includes standard environment setup and diagnostic tools.\n
- Evidence:
SKILL.mdsuggests usingpip install tooluniverseto manage dependencies.\n - Evidence: Several test scripts (
test_gwas_tools.py,test_skill_comprehensive.py) are included to verify tool and workflow functionality within the execution environment.
Audit Metadata