clinvar-database

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches genomic data, clinical variant reports, and configuration files from official National Center for Biotechnology Information (NCBI) endpoints, including ncbi.nlm.nih.gov and eutils.ncbi.nlm.nih.gov. These operations are consistent with established bioinformatics workflows.
  • [REMOTE_CODE_EXECUTION]: Provides instructions to install the entrezdirect utility suite by piping a setup script from the NCBI FTP server (ftp.ncbi.nlm.nih.gov) directly to the shell. This is a standard and trusted distribution method for official NIH genomic software.
  • [COMMAND_EXECUTION]: Demonstrates the use of local command-line utilities such as bcftools, awk, curl, and wget to automate scientific data retrieval and variant call set processing.
  • [DATA_EXFILTRATION]: Correctly guides users on the implementation of API keys and administrative contact information (email) for NCBI's E-utilities services. The skill does not contain hardcoded credentials or evidence of unauthorized data transmission.
  • [PROMPT_INJECTION]: The skill was analyzed for behavioral override patterns and deceptive instructions. No malicious patterns were identified. Regarding indirect injection surfaces:
  • Ingestion points: Genomic data (XML, VCF, and tab-delimited files) from ftp.ncbi.nlm.nih.gov and JSON responses from eutils.ncbi.nlm.nih.gov.
  • Boundary markers: No specific delimiters or warnings for embedded instructions are present in the code examples.
  • Capability inventory: curl, wget, bcftools (shell), and Python-based data processing.
  • Sanitization: Code snippets demonstrate standard parsing logic without explicit content sanitization.
  • Note: Given the authoritative nature of the government source, the risk associated with this ingestion surface is considered safe.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 11:42 AM
Security Audit — agent-trust-hub — clinvar-database