protein-structure
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The file
references/patterns.mdcontains Python patterns that usesubprocess.runto execute external bioinformatics tools includingcolabfold_batch,TMalign, andalphafill. These commands are constructed using lists, which mitigates shell injection risks, but they depend on the presence of these binaries on the host system. - [EXTERNAL_DOWNLOADS]: The documentation in
references/patterns.mdsuggests the installation of thecolabfoldpackage usingpipand refers to the externalalphafill.euservice for structural data enhancement. - [PROMPT_INJECTION]: The skill exhibits an attack surface for Indirect Prompt Injection because it ingests and processes untrusted data from external biological files.
- Ingestion points: Protein sequence data (FASTA) in
predict_structure_colabfold, structural data (PDB) incalculate_rmsd,run_dssp, andcalculate_sasa, and confidence data (JSON) inload_pae_from_json. - Boundary markers: None; external file content is read and processed directly without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill can perform file system operations (reading and writing files) and execute specific external binaries via
subprocess.run. - Sanitization: There is no evidence of sanitization or validation for the content of the processed files or the resulting command-line arguments beyond basic string conversion.
Audit Metadata