ncbi-blast-skill
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Package Installation: The skill requires the
requestslibrary to manage API communications and provides instructions for its installation viapip. This involves downloading code from the standard public package registry (PyPI). - Network Communication: The script interacts with the National Center for Biotechnology Information (NCBI) BLAST API. This communication is essential for sequence search functionality and includes rate-limiting logic to follow provider guidelines.
- File Output Capability: The skill can write raw search results to the local filesystem, either in a default temporary directory or a user-specified path. This enables the management of large datasets that exceed context limits.
- Indirect Prompt Injection Surface: The tool processes data from an external source (NCBI search hits), which may include untrusted strings such as query titles or sequence descriptions.
- Ingestion points: Data is fetched from the NCBI BLAST API and parsed into the agent's context within
scripts/ncbi_blast.py. - Boundary markers: The skill does not employ specific delimiters for external content, though it favors compact summaries to limit exposure.
- Capability inventory: The associated script has the ability to perform network requests and write files to the disk.
- Sanitization: The script parses structured JSON results but does not perform additional sanitization on the descriptive text fields of the biological hits.
Audit Metadata