anndata
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows standard practices for the anndata Python package and its associated scverse ecosystem. No malicious code or instructions were found.
- [EXTERNAL_DOWNLOADS]: The skill documents functionality for loading data from remote sources such as S3, GCS, or HTTPS URLs using fsspec and urllib. The reference material includes a security best-practice example that validates the URL scheme and hostname before initiating a download.
- [COMMAND_EXECUTION]: Installation instructions provide standard commands to install the anndata package using uv pip. These commands are appropriate for the tool's intended use.
- [PROMPT_INJECTION]: The skill has a data ingestion surface through reading various file formats (H5AD, Zarr, CSV) and remote URLs. Ingestion points: Reads h5ad, zarr, csv, mtx, loom, and URLs (documented in SKILL.md and references/io_operations.md). Boundary markers: Absent for file content. Capability inventory: Permissions for Bash, Write, and Edit tools are requested in SKILL.md. Sanitization: The skill includes a code snippet in references/io_operations.md demonstrating how to validate the hostname and protocol of external URLs before processing.
Audit Metadata