このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。
バージョン付きセキュリティ評価
レポートID: SA-0887AFC9
7/5/2026, 9:29:00 AM
reactome-database セキュリティ評価 v7
スキルセキュリティ認証レポート
監査モデル: codex 過去のレポート
- スキル名
- reactome-database
- バージョン
- v7
- メンテナー
- davila7
- カバレッジ
- 3 スキャンされたファイル · 1,026 解析済み行数
- ポリシーバージョン
- 利用不可
確認済み検出結果の概要
確認済みのセキュリティ上の指摘はありません
完了した監査では、確認済みのセキュリティ上の検出事項は記録されませんでした。これは、Skill に副作用がないことの証明ではありません。
インストールのコンテキスト
履歴上の証拠
このレポートは、現在インストール可能な成果物を説明していない可能性があります。インストールに関するガイダンスについては、現在の Skill ページを開いてください。
現在のスキルページを開くこのレポートは、マニフェストまたは ZIP をブロックも承認もしません。
The skill intentionally uses Reactome REST endpoints and a helper script to submit identifiers, retrieve tokens, and build browser URLs. No prompt injection, credential access, or malicious command execution was found; most high and medium static hits are Markdown or URL parsing false positives. The main actionable risks are expected third-party data submission and one helper-script file write that can overwrite a user-derived results path.
レポートの位置
過去のレポート
このレポートを使用してインストールする前に、監査履歴を開いてください。
監査アテステーション
証明不可
必要な不変のバインディングは不完全です。
人による検証
未検証
このレポートには人による検証は記録されていません。
カバレッジ
3 スキャンされたファイル · 1,026 解析済み行数
レビュー対象の項目を 48 件表示
制限事項
このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。
証拠チェーン
ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。
ソース
バインディングは利用できません
アーティファクト
IDが不完全
監査
完了
確認された機能
「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。
スクリプトを含む
Skillに含まれるコードを実行する場合があります。
この監査では記録されていません
ネットワークアクセス
外部サービスに接続する場合があります。
48 件の証拠箇所で確認
ファイルシステムへのアクセス
ローカルファイルの読み取りまたは書き込みを行う可能性があります。
4 件の証拠箇所で確認
環境変数
プロセス環境から値を読み取る可能性があります。
この監査では記録されていません
外部コマンド
Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。
33 件の証拠箇所で確認
機能レビュー項目 (48)
中
Python file write/append
with open(output_file, 'w') as f:
The analyze command writes full results to a filename derived from the user-supplied input path. Without overwrite checks, this can clobber local files or place data in an unexpected path.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/database/version")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278/displayName")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.post(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
result = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.post(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.post(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/database/version")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278/displayName")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/ContentService/data/event/R-HSA-69278/participatingPhysicalEntities"
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/ContentService/data/query",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
result = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/projection/",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
url = f"https://reactome.org/PathwayBrowser/#{top_pathway['stId']}&DTAB=AN&ANALYSIS={token}"
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(f"{self.CONTENT_BASE}/data/database/version")
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(f"{self.CONTENT_BASE}/data/query/{pathway_id}")
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.post(
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(f"{self.ANALYSIS_BASE}/token/{token}")
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Hardcoded URL
CONTENT_BASE = "https://reactome.org/ContentService"
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Hardcoded URL
ANALYSIS_BASE = "https://reactome.org/AnalysisService"
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Hardcoded URL
url = f"https://reactome.org/PathwayBrowser/#{top_pathway}&DTAB=AN&ANALYSIS={token}"
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/database/version")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.get(f"https://reactome.org/ContentService/data/query/{entity_id}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.get(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.post(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.post(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.post(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
**API Base URL:** `https://reactome.org/ContentService`
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
**API Base URL:** `https://reactome.org/AnalysisService`
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/database/version")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
response = requests.get(f"https://reactome.org/ContentService/data/query/{entity_id}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
f"https://reactome.org/ContentService/data/event/{event_id}/participatingPhysicalEntities"
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/projection/",
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
url = f"https://reactome.org/PathwayBrowser/#{pathway_id}&DTAB=AN&ANALYSIS={token}"
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
この完了済み監査には、確認済みのセキュリティ検出事項は記録されていません。
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
- FIX-001中scripts/reactome_query.py writes results to a filename derived from the input path.Add an explicit output argument, refuse overwrites by default, and require a force option for replacement.
- FIX-002低Reactome analysis sends user identifiers or expression data to an external service.Add a clear privacy warning before live analysis and advise users not to submit restricted or patient-linked data without approval.
- FIX-003低Requests examples and helper methods do not set network timeouts.Add reasonable timeouts and retry guidance so API failures do not hang long-running analysis workflows.
専門家による証拠
不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。
アーティファクト主体
- Marketplace コミット
- 利用不可
- コンテンツハッシュ
- 利用不可
- ツリーハッシュ
- 利用不可
- Skill パス
- 利用不可
- 監査ペイロードハッシュ
- 利用不可
分析メタデータ
監査モデル: codex
分析状態: 完了
対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。
検証とエクスポート
マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。
監査アテステーション: not_attestable