locus-to-gene-mapper-skill
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill utilizes
subprocess.runto invoke internal Python scripts for specialized operations, such as eQTL and gene burden analysis. These execution calls target specific relative paths within the skill's environment and use standard JSON communication to pass parameters, which is a standard pattern for modular skill design. - External Data Retrieval: The workflow involves fetching biological data from recognized scientific repositories, including EMBL-EBI, Open Targets, NCBI, and the Broad Institute. These operations use the
requestslibrary to access hardcoded API endpoints for legitimate research purposes. - Indirect Prompt Injection Surface: As the skill ingests structured and natural language data from various external bioinformatics APIs and reflects it in generated summaries, there is an inherent surface for indirect prompt injection. This is a common architectural consideration for data-driven agent skills that aggregate third-party information.
- Local File and Directory Management: The skill is designed to write its analysis results, including JSON mapping files, markdown summaries, and genomic visualizations (PNGs), to a local output directory. This behavior supports the skill's objective of providing persistent and reproducible research artifacts.
Audit Metadata