clinvar-database
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches genomic data, clinical variant reports, and configuration files from official National Center for Biotechnology Information (NCBI) endpoints, including
ncbi.nlm.nih.govandeutils.ncbi.nlm.nih.gov. These operations are consistent with established bioinformatics workflows. - [REMOTE_CODE_EXECUTION]: Provides instructions to install the
entrezdirectutility suite by piping a setup script from the NCBI FTP server (ftp.ncbi.nlm.nih.gov) directly to the shell. This is a standard and trusted distribution method for official NIH genomic software. - [COMMAND_EXECUTION]: Demonstrates the use of local command-line utilities such as
bcftools,awk,curl, andwgetto automate scientific data retrieval and variant call set processing. - [DATA_EXFILTRATION]: Correctly guides users on the implementation of API keys and administrative contact information (email) for NCBI's E-utilities services. The skill does not contain hardcoded credentials or evidence of unauthorized data transmission.
- [PROMPT_INJECTION]: The skill was analyzed for behavioral override patterns and deceptive instructions. No malicious patterns were identified. Regarding indirect injection surfaces:
- Ingestion points: Genomic data (XML, VCF, and tab-delimited files) from
ftp.ncbi.nlm.nih.govand JSON responses fromeutils.ncbi.nlm.nih.gov. - Boundary markers: No specific delimiters or warnings for embedded instructions are present in the code examples.
- Capability inventory:
curl,wget,bcftools(shell), and Python-based data processing. - Sanitization: Code snippets demonstrate standard parsing logic without explicit content sanitization.
- Note: Given the authoritative nature of the government source, the risk associated with this ingestion surface is considered safe.
Audit Metadata