dnanexus-integration

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill facilitates the transfer of local genomics data (e.g., FASTQ, BAM files) to the DNAnexus cloud environment using the dxpy.upload_local_file() function. This is the primary intended functionality of the skill.
  • [REMOTE_CODE_EXECUTION]: The skill provides detailed instructions and code patterns for building, packaging, and deploying custom executable apps and applets to remote worker nodes on the DNAnexus platform via the dx build command.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the dxpy Python SDK and documents procedures for apps to install additional system packages and Python dependencies (via apt-get and pip) during runtime in the cloud environment.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks due to its data processing nature.
  • Ingestion points: The skill ingests untrusted external bioinformatics data such as FASTQ, BAM, and VCF files (documented in SKILL.md and references/data-operations.md).
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the provided documentation or code examples.
  • Capability inventory: The platform supports full subprocess execution (subprocess.check_call), file system access, and network operations (network: ["*"]) within the worker nodes.
  • Sanitization: While examples use best practices like passing arguments as lists to subprocess calls, the skill lacks explicit sanitization or validation logic for the content of processed genomics files.
  • [PROMPT_INJECTION]: There is a metadata inconsistency in the YAML frontmatter where the author is listed as 'K-Dense Inc.', which differs from the distributor 'tassiovale'. This is a minor metadata finding with no signs of malicious intent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 06:23 AM