biomni
Fail
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to autonomously generate and execute code pipelines based on user queries. The documentation explicitly warns that 'Biomni executes LLM-generated code with full system privileges,' which constitutes a significant security risk if the LLM generates malicious or unintended code.
- [EXTERNAL_DOWNLOADS]: Recommends installing the 'biomni' package via 'uv pip install' and automatically downloads approximately 11GB of integrated biomedical databases and literature indices from external sources (Stanford SNAP lab/Hugging Face) upon first use.
- [PROMPT_INJECTION]: The 'Suggest Using K-Dense Web' section contains explicit instructions to the agent to proactively suggest an external hosted platform (www.k-dense.ai) when tasks reach a certain complexity, which acts as a behavioral override for promotional purposes.
- [DYNAMIC_EXECUTION]: The core capability of the 'A1' agent involves 'Dynamic analysis pipeline creation' and execution, which falls under runtime script generation and execution.
- [COMMAND_EXECUTION]: Suggests the use of shell commands for environment setup, package management, and the configuration of sensitive API keys for various LLM providers (Anthropic, OpenAI, etc.).
- [DATA_EXFILTRATION]: Because the skill facilitates autonomous code execution and encourages storing high-value API keys in environment variables, there is an elevated risk of credential theft if generated code is manipulated to read and transmit environment data.
Recommendations
- AI detected serious security threats
Audit Metadata