protein-sequence-similarity-search
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (ColabFold and EBI APIs) and user-provided FASTA files to generate protein similarity reports.
- Ingestion points: Biological sequence data and metadata returned from the MMseqs2 and BLAST APIs are parsed and written to Markdown and JSON files.
- Boundary markers: No explicit delimiters are used in the generated Markdown to separate untrusted API content from agent instructions.
- Capability inventory: The skill uses
uv runfor script execution, performs network requests to external APIs, and writes result files to the local workspace. - Sanitization: While the scripts parse specific numeric and identifier fields, there is no comprehensive sanitization of the protein descriptions or metadata strings returned by the remote services.
- [EXTERNAL_DOWNLOADS]: The skill communicates with scientific web services to perform protein searches.
- Fetches search results and archives from
api.colabfold.comandwww.ebi.ac.uk. - These are well-known bioinformatics resources used for legitimate research purposes.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute local Python scripts using the
uvtool. - Commands are used to run
scripts/mmseqs2_search.pyandscripts/uniprot_blast.pywith user-defined parameters. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the
~/.envfile to retrieve theUSER_EMAILenvironment variable. - This information is used for job tracking in headers sent to the EBI BLAST API, following the skill's defined protocol for handling user credentials.
Audit Metadata