Histórico de auditoria

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: codex

Versão da auditoria 14

9 de jul. de 2026, 09:23

The static scanner over-reported many Markdown code fence, identifier, and placeholder patterns. I confirmed only the FTP transport findings because the skill documents unauthenticated ftp:// downloads from NCBI; no prompt injection or credential exfiltration intent was found.

2

Arquivos analisados

1,640

Linhas analisadas

11

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (7)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: codex

Versão da auditoria 13

9 de jul. de 2026, 16:03

The skill is primarily documentation and examples for public NCBI GEO data access. Most static findings are false positives caused by Markdown fences, official public URLs, placeholder keys, dictionary key access, and genomics identifiers. The FTP references are confirmed medium-risk because they recommend unauthenticated transport and recursive downloads that can affect data integrity and local resources.

2

Arquivos analisados

1,640

Linhas analisadas

11

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (7)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The skill points users to ftp:// GEO downloads, including direct and recursive retrieval. FTP lacks transport integrity, so public data can be tampered with in transit and bulk downloads can create operational risk.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: codex

Versão da auditoria 12

9 de jul. de 2026, 09:23

The static scanner over-reported many Markdown code fence, identifier, and placeholder patterns. I confirmed only the FTP transport findings because the skill documents unauthenticated ftp:// downloads from NCBI; no prompt injection or credential exfiltration intent was found.

2

Arquivos analisados

1,640

Linhas analisadas

11

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (7)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The skill documents ftp:// access to NCBI GEO over unauthenticated FTP. Public data reduces impact, but downloaded content can be tampered with in transit; prefer HTTPS or checksum verification.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: codex

Versão da auditoria 11

9 de jul. de 2026, 04:29

The skill is a documentation-heavy GEO database helper with many examples for public NCBI APIs, GEOparse, FTP downloads, and local file caching. Most static findings are false positives caused by markdown code fences, official URLs, biomedical identifiers, and Python .keys() usage. Remaining confirmed issues are expected but real risks from plaintext FTP recommendations, local file writes, and user-run shell commands.

2

Arquivos analisados

1,640

Linhas analisadas

16

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (12)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

SKILL.md:141-143 SKILL.md:397-406 SKILL.md:643-658

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

Ruby/shell backtick execution · 3 ocorrências

```bash

The finding points to markdown shell-command examples. They are user-visible and relevant to installation or GEO download workflows, but they still instruct users to execute external commands.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The skill recommends FTP URLs for downloading public GEO data. FTP is plaintext and lacks transport integrity, so users could receive tampered data on untrusted networks.

Médio

SKILL.md:381

Python file write/append

with open(local_file, 'wb') as f:

The example writes downloaded GEO files to a local destination path. This is expected for dataset workflows but still represents filesystem write behavior that users should review.

Médio

SKILL.md:378

Python os file operations

os.makedirs(dest_dir, exist_ok=True)

The example creates local directories before saving downloaded GEO data. This is expected behavior but confirms filesystem modification capability.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: claude

Versão da auditoria 10

9 de jul. de 2026, 01:32

Most static findings are false positives from Markdown examples, public NCBI documentation links, placeholder API key text, and GEO accession examples. The confirmed issues are the repeated recommendation of FTP download URLs, which creates transport security and integrity risks for downloaded research data.

2

Arquivos analisados

1,640

Linhas analisadas

11

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (7)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The documentation recommends or lists FTP access to NCBI GEO at references/geo_reference.md:504. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The documentation recommends or lists FTP access to NCBI GEO at references/geo_reference.md:541. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The documentation recommends or lists FTP access to NCBI GEO at references/geo_reference.md:551. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The documentation recommends or lists FTP access to NCBI GEO at SKILL.md:399. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The documentation recommends or lists FTP access to NCBI GEO at SKILL.md:402. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The documentation recommends or lists FTP access to NCBI GEO at SKILL.md:405. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The documentation recommends or lists FTP access to NCBI GEO at SKILL.md:806. FTP is unencrypted and unauthenticated, so downloads can be observed or modified in transit.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: claude

Versão da auditoria 9

8 de jul. de 2026, 06:24

Most static findings are false positives from Markdown examples, official GEO and NCBI URLs, placeholders, and scientific identifiers. Confirmed risks are unencrypted FTP download guidance and local file write examples that may create directories and files when followed. No prompt injection, secret exfiltration intent, or malicious business logic was found.

2

Arquivos analisados

1,640

Linhas analisadas

13

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (9)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The skill documents or demonstrates ftp:// access to NCBI GEO resources. FTP is cleartext and unauthenticated, so downloaded public data could be tampered in transit.

Médio

SKILL.md:381

Python file write/append

with open(local_file, 'wb') as f:

The example writes downloaded content to a local file built from the destination directory and accession. This intended caching behavior modifies the filesystem and needs path validation.

Médio

SKILL.md:378

Python os file operations

os.makedirs(dest_dir, exist_ok=True)

The example creates a caller-supplied destination directory before downloading GEO data. This is expected behavior, but it can write outside an intended workspace if paths are not constrained.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: codex

Versão da auditoria 8

5 de jul. de 2026, 09:15

The high static score is driven mostly by false positives in Markdown examples, public GEO URLs, placeholder API-key text, and biomedical identifiers. The only confirmed issue is the documented use of plaintext FTP for GEO downloads, which should be replaced or guarded with safer download guidance.

2

Arquivos analisados

1,640

Linhas analisadas

11

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (7)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

Auditado por: codex

Versão da auditoria 7

5 de jul. de 2026, 09:15

The high static score is driven mostly by false positives in Markdown examples, public GEO URLs, placeholder API-key text, and biomedical identifiers. The only confirmed issue is the documented use of plaintext FTP for GEO downloads, which should be replaced or guarded with safer download guidance.

2

Arquivos analisados

1,640

Linhas analisadas

11

Itens de revisão

0

Falsos positivos ignorados

Itens de revisão de capacidade (7)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE{nnn}nnn/GSE{xxxxx}/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/samples/GSM{nnn}nnn/GSM{xxxxx}/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/geo/platforms/GPL{nnn}nnn/GPL{xxxxx}/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/matrix/GSE123456_series_matrix.txt.gz

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

wget -r -np -nd ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/suppl/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

wget ftp://ftp.ncbi.nlm.nih.gov/geo/series/GSE123nnn/GSE123456/soft/GSE123456_family.soft.gz

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Médio

FTP protocol

- **GEO FTP Site:** ftp://ftp.ncbi.nlm.nih.gov/geo/

The finding is a documented NCBI GEO FTP path or command, not a hidden endpoint. It remains a real risk because FTP is plaintext and the examples encourage direct downloads without integrity verification.

Fatores de risco

🌐 Acesso à rede (26)

⚙️ Comandos externos (39)

📁 Acesso ao sistema de arquivos (2)

🔑 Variáveis de ambiente (1)

SKILL.md:141-142 SKILL.md:373-384 SKILL.md:397-405 SKILL.md:564-576

Auditado por: codex

Versão da auditoria 6

29 de jun. de 2026, 13:53

Static analysis flagged many dangerous patterns, but most high and critical signals are false positives from Markdown code fences, genomics identifiers, and documentation examples. The skill is not malicious, but it provides executable examples for package installation, NCBI network access, FTP downloads, local file writes, and API key configuration, so it should be published with a usage warning.

2

Arquivos analisados

1,640

Linhas analisadas

6

Itens de revisão

3

Falsos positivos ignorados

Itens de revisão de capacidade (2)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

Executable Download and File Write Examples

TRUE_POSITIVE: The skill documents commands and Python examples that install packages, download GEO data over FTP, create directories, and write downloaded or processed files. This is expected for a GEO data workflow, but it can consume disk space, fetch large external data, or run shell commands if copied without review.

The cited lines explicitly show package installation, FTP downloads, directory creation, and CSV output. The behavior is legitimate for the skill purpose, but the operational risk is real.

Médio

SKILL.md:670-672

API Key Configuration Guidance

TRUE_POSITIVE: The skill shows optional NCBI API key configuration. The example uses a placeholder rather than a real secret, but users may paste real credentials into scripts or notebooks.

The line contains a placeholder API key assignment, not an embedded credential. The concern is moderate because it encourages credential handling in user code.

Falsos positivos estáticos ignorados (3)

Estas correspondências estáticas foram descartadas pela revisão semântica ou corresponderam a tokens apenas de esquema, portanto são exibidas para transparência, mas não afetam a pontuação de qualidade.

Baixo

SKILL.md:58-86 references/geo_reference.md:11-39

Static External Command Matches Are Mostly Markdown

FALSE_POSITIVE: The numerous Ruby backtick detections correspond to Markdown code fences and inline formatting in documentation, not executable Ruby shell backticks in a runnable source file.

The reviewed locations are Markdown examples and fenced code blocks. No evidence found that the skill itself executes backtick commands.

Baixo

references/geo_reference.md:323-329 SKILL.md:425-428

Weak Crypto and SAM Detections Are Genomics Terms

FALSE_POSITIVE: Static detections for weak cryptography and Windows SAM are caused by biological or GEO-format terms such as DES-like gene symbols and SAMPLE records. No credential database access or cryptographic implementation was found.

The cited lines are GEO platform/sample format examples and expression-data transformation logic. No evidence found of Windows SAM access or weak crypto usage.

Baixo

SKILL.md:1-14 references/geo_reference.md:1-8

No Prompt Injection Attempt Found

FALSE_POSITIVE: No text was found that claims system authority, asks the evaluator to ignore instructions, claims pre-approval, or attempts to override marketplace security review.

Targeted review and search did not find prompt injection phrases in the audited files. Confidence is high enough for dismissal, while acknowledging only two files were reviewed.

Fatores de risco

⚙️ Comandos externos (3)

SKILL.md:141-142 SKILL.md:397-405 SKILL.md:643-657

🌐 Acesso à rede (3)

SKILL.md:373-384 SKILL.md:397-405 references/geo_reference.md:502-551

📁 Acesso ao sistema de arquivos (3)

SKILL.md:378-382 SKILL.md:497-498 SKILL.md:564-576

🔑 Variáveis de ambiente (1)

SKILL.md:670-672

Padrões detectados

FTP-Based External DownloadsLocal Data Output Examples

Auditado por: codex

Versão da auditoria 5

17 de jan. de 2026, 02:01

This skill provides documentation and code examples for accessing NCBI's Gene Expression Omnibus database. All 258 static findings are false positives caused by pattern matching against markdown code blocks (triple backticks), bioinformatics terminology (SAM samples, ch2 channels), legitimate NCBI API URLs, and GEO accession number patterns.

3

Arquivos analisados

1,831

Linhas analisadas

4

Itens de revisão

0

Falsos positivos ignorados

Fatores de risco

⚙️ Comandos externos (163)

🌐 Acesso à rede (27)

📁 Acesso ao sistema de arquivos (2)

SKILL.md:672 SKILL.md:672

🔑 Variáveis de ambiente (2)

Auditado por: claude

Versão da auditoria 4

17 de jan. de 2026, 02:01

This skill provides documentation and code examples for accessing NCBI's Gene Expression Omnibus database. All 258 static findings are false positives caused by pattern matching against markdown code blocks (triple backticks), bioinformatics terminology (SAM samples, ch2 channels), legitimate NCBI API URLs, and GEO accession number patterns.

3

Arquivos analisados

1,831

Linhas analisadas

4

Itens de revisão

0

Falsos positivos ignorados

Fatores de risco

⚙️ Comandos externos (163)

🌐 Acesso à rede (27)

📁 Acesso ao sistema de arquivos (2)