gnomad-graphql-skill
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [File Access Consideration]: The skill provides the ability to read GraphQL queries from local files via the
query_pathparameter and save raw response data usingraw_output_path. These capabilities are functional requirements for managing complex datasets and query files but involve direct interaction with the local file system.\n- [Data Retrieval from Trusted Service]: The skill fetches genomic and variant information from the Broad Institute's gnomAD API. This network activity is central to the skill's purpose and targets a well-known, trusted scientific resource.\n- [Information Exposure Management]: The script implements a truncation utility (_compact) that limits the length of strings and the depth of nested objects returned in the summary. This helps manage the volume of data presented to the user and reduces potential information exposure.\n- [Indirect Prompt Injection Surface]: The skill processes data from an external API and allows file-system interaction, creating a potential surface for indirect injection.\n - Ingestion points: Data is ingested from the gnomAD API and optionally from local files via
query_pathinscripts/gnomad_graphql.py.\n - Boundary markers: The skill does not explicitly use boundary markers or delimiters for the ingested data.\n
- Capability inventory: The skill performs network POST requests, local file reading, and local file writing.\n
- Sanitization: Large fields and deep nested structures are truncated in the output summary, which mitigates the impact of large injected payloads.
Audit Metadata