protein-sequence-similarity-search

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (ColabFold and EBI APIs) and user-provided FASTA files to generate protein similarity reports.
  • Ingestion points: Biological sequence data and metadata returned from the MMseqs2 and BLAST APIs are parsed and written to Markdown and JSON files.
  • Boundary markers: No explicit delimiters are used in the generated Markdown to separate untrusted API content from agent instructions.
  • Capability inventory: The skill uses uv run for script execution, performs network requests to external APIs, and writes result files to the local workspace.
  • Sanitization: While the scripts parse specific numeric and identifier fields, there is no comprehensive sanitization of the protein descriptions or metadata strings returned by the remote services.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with scientific web services to perform protein searches.
  • Fetches search results and archives from api.colabfold.com and www.ebi.ac.uk.
  • These are well-known bioinformatics resources used for legitimate research purposes.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute local Python scripts using the uv tool.
  • Commands are used to run scripts/mmseqs2_search.py and scripts/uniprot_blast.py with user-defined parameters.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the ~/.env file to retrieve the USER_EMAIL environment variable.
  • This information is used for job tracking in headers sent to the EBI BLAST API, following the skill's defined protocol for handling user credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:46 AM
Security Audit — agent-trust-hub — protein-sequence-similarity-search