The Agent Skills Directory

Potential for Arbitrary File Write: The scripts/biobankjapan_phewas.py script accepts a user-provided raw_output_path parameter. The script uses Path(raw_output_path).expanduser() to resolve the path and write_text() to save JSON-formatted association data to that location. In the absence of path validation or a restricted output directory, a user or a malicious prompt could potentially instruct the agent to overwrite sensitive configuration files or shell profiles (e.g., ~/.bashrc or ~/.ssh/config). Although the data written is limited to the JSON response from the genomic API, overwriting system files can disrupt configurations or facilitate further exploitation.
Network Operations with Genomic Data Services: The skill communicates with external genomic databases at https://pheweb.jp and https://rest.ensembl.org. These requests are necessary for variant resolution and fetching PheWAS associations. The skill correctly sanitizes inputs using requests.utils.quote before embedding them in URLs, which helps prevent URL manipulation. The communication uses standard headers and reasonable timeouts.
Genomic Input Validation: The skill implements robust parsing and validation for genetic variant identifiers (rsIDs and genomic coordinates) in scripts/variant_resolution.py. It uses regular expressions to verify chromosome names and allele formats, ensuring that only expected biological data formats are processed by the internal logic.

biobankjapan-phewas-skill