tooluniverse-rnaseq-deseq2
Fail
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Multiple instances of insecure command generation were detected where user-supplied file paths are interpolated directly into code strings that are later executed.\n
- In
scripts/convert_rds_to_csv.py, therds_pathargument is inserted into an R script template using an f-string:result <- readRDS(\"{rds_path}\"). This script is then executed viasubprocess.run(['Rscript', ...]).\n - In
references/data_loading.md, example code forrpy2demonstrates the same vulnerability:ro.r(f'df <- as.data.frame(readRDS(\"{rds_file}\"))').\n - These patterns allow an attacker to execute arbitrary R or system commands by providing a specially crafted filename (e.g., using quotes and semicolons to break out of the string and run additional commands).\n- [EXTERNAL_DOWNLOADS]: The skill utilizes and suggests the installation of several standard bioinformatics libraries.\n
- Dependencies include
pydeseq2,gseapy,pandas,numpy,scipy,anndata,statsmodels, andtooluniverse.\n - These packages are sourced from standard repositories (PyPI) and are well-established within the scientific community.
Recommendations
- AI detected serious security threats
Audit Metadata