Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it sends user-provided biological sequences to NCBI BLAST and optionally writes the returned alignment results to a file.
Install only if you are comfortable sending the sequences you provide to NCBI's external BLAST service. Do not use unpublished, proprietary, regulated, or sample-identifying sequence data unless that external submission is approved, and choose output paths deliberately because the script writes to the path supplied by the user.
The skill advertises and operationalizes network access and file output through scripts/main.py, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: an agent or reviewer cannot easily enforce or audit that only the intended capabilities are used, increasing the risk of overbroad file writes or unexpected outbound access.
The skill describes BLAST API use but does not clearly warn users, at the point of input collection or usage, that submitted biological sequences will be transmitted to an external NCBI service. If users provide proprietary, unpublished, regulated, or otherwise sensitive sequence data, this omission can lead to unintended external disclosure and compliance issues.
The script sends the full user-provided biological sequence to the external NCBI BLAST service without any explicit consent flow, privacy notice, or warning that the data leaves the local environment. In many bioinformatics contexts, sequences may be proprietary, unpublished, regulated, or linked to sensitive samples, so silent exfiltration to a third-party service creates a real confidentiality and compliance risk.
