biomni
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the agent processes external biomedical datasets (such as GWAS results, single-cell RNA-seq data, and PubMed literature) and uses this information to generate and execute analysis code.\n
- Ingestion points: Untrusted data enters the context via file paths provided in research queries (e.g., .h5ad, .vcf, .csv files) processed by the agent.go() method.\n
- Boundary markers: The instructions do not specify the use of delimiters or instructions to ignore embedded commands within the processed research data.\n
- Capability inventory: The agent possesses full Python code execution capabilities through the A1 class, which generates and runs scripts autonomously across research tasks.\n
- Sanitization: The documentation recommends running the agent in isolated environments (Docker or VMs) but does not implement automated sanitization of data-derived prompts.\n- [COMMAND_EXECUTION]: The setup script (scripts/setup_environment.py) uses shell commands to automate the creation of Conda environments and the installation of the biomni package. These operations use controlled arguments and are standard for development environment setup.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of a large biomedical data lake (~11GB) and pre-trained models from Stanford SNAP lab domains and HuggingFace repositories. These are well-known academic and community resources relevant to the skill's research purpose.
Audit Metadata