biopython
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs and uses the 'biopython' package. This is a well-established and trusted open-source library used extensively in the scientific community.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to well-known NCBI (National Center for Biotechnology Information) services for data retrieval and sequence analysis. These are official government-operated scientific resources.
- [COMMAND_EXECUTION]: The skill provides patterns for running external bioinformatics binaries (such as BLAST+, Clustal Omega, and MUSCLE) via the
subprocessmodule. It includes explicit security warnings to validate file paths and avoid interpolating unsanitized user input into these commands, which mitigates injection risks. - [SAFE]: Secret management follows industry standards by instructing users to load the 'NCBI_API_KEY' from environment variables rather than hardcoding credentials.
- [SAFE]: The skill demonstrates high security awareness by explicitly referencing a past vulnerability (CVE-2025-68463) and recommending the use of the patched version (1.87+) for handling untrusted files.
Audit Metadata