cosmic-database

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of scientific datasets (TSV, VCF, CSV) from the official COSMIC database at cancer.sanger.ac.uk. These downloads consist of genomic data for research purposes and do not involve remote code execution.
  • [COMMAND_EXECUTION]: The provided scripts/download_cosmic.py script includes a command-line interface for data retrieval. It utilizes getpass to securely prompt for credentials, avoiding the need for plaintext passwords in shell history when used interactively.
  • [DATA_EXFILTRATION]: User credentials (email and password) are transmitted solely to the official COSMIC authentication endpoint to authorize data access. This is the intended functionality of the skill and targets a reputable academic domain.
  • [SAFE_PRACTICES]: The download utility implements safe file handling by using os.path.basename to sanitize output filenames, which prevents path traversal vulnerabilities if a malicious or malformed file path is requested from the server.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 02:23 AM