dnanexus-integration
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill facilitates the transfer of local genomics data (e.g., FASTQ, BAM files) to the DNAnexus cloud environment using the
dxpy.upload_local_file()function. This is the primary intended functionality of the skill. - [REMOTE_CODE_EXECUTION]: The skill provides detailed instructions and code patterns for building, packaging, and deploying custom executable apps and applets to remote worker nodes on the DNAnexus platform via the
dx buildcommand. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
dxpyPython SDK and documents procedures for apps to install additional system packages and Python dependencies (viaapt-getandpip) during runtime in the cloud environment. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks due to its data processing nature.
- Ingestion points: The skill ingests untrusted external bioinformatics data such as FASTQ, BAM, and VCF files (documented in SKILL.md and references/data-operations.md).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the provided documentation or code examples.
- Capability inventory: The platform supports full subprocess execution (
subprocess.check_call), file system access, and network operations (network: ["*"]) within the worker nodes. - Sanitization: While examples use best practices like passing arguments as lists to subprocess calls, the skill lacks explicit sanitization or validation logic for the content of processed genomics files.
- [PROMPT_INJECTION]: There is a metadata inconsistency in the YAML frontmatter where the author is listed as 'K-Dense Inc.', which differs from the distributor 'tassiovale'. This is a minor metadata finding with no signs of malicious intent.
Audit Metadata