mab-fto-check
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/mab_fto_recall_estimator.py) to perform statistical calculations (Chapman capture-recapture estimation) for search recall. This is a legitimate use of local command execution for a provided utility script. - [EXTERNAL_DOWNLOADS]: The skill retrieves patent information from
eureka.zhihuiya.comand directs users toopen.zhihuiya.comfor authentication. These are official domains associated with the skill's author (Patsnap) and are required for the tool's core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of biological sequences (e.g., VH, VL, CDR regions). Although this represents a potential attack surface where instructions could be hidden in sequence data, the skill uses these inputs primarily as parameters for specialized search tools (
ls_sequence_alignment), which significantly limits the risk of the agent executing arbitrary commands from the data.
Audit Metadata