gnomad-graphql-skill

No clear evidence of malware or supply-chain backdoor behavior is present. The code is a straightforward gnomAD GraphQL client, but its caller-controlled query_path and raw_output_path create arbitrary file read/write risks, including possible path traversal and unintended file modification. These risks should be mitigated by restricting paths to approved directories, rejecting traversal and absolute paths where appropriate, and using safe temporary-file handling.