gwas-catalog-skill
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Arbitrary Command Execution via Parameter Injection: The skill executes a Python script (
scripts/rest_request.py) using input provided viastdin. While the script uses standard libraries and validates input types, the design allows the agent to construct and execute shell commands that pipe data into the script. This is a core part of the skill's operational design. - File System Interactions: The script includes functionality to save raw API responses to the local filesystem (e.g., in
/tmp/). This is used to handle large payloads or when the user explicitly requests raw output, which is a standard pattern for managing tool outputs in agentic environments. - Network Operations: The skill makes HTTP requests to the official GWAS Catalog API (
ebi.ac.uk). These operations are consistent with the skill's stated purpose of fetching genomic study summaries.
Audit Metadata