Skills busco-phylogeny
📦
busco-phylogeny
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Build BUSCO Phylogenies from Genome Assemblies
Genome-to-tree phylogenomics requires many tools, file transformations, and scheduler settings. This skill creates a tailored BUSCO/compleasm workflow with scripts, quality checks, tree inference, and methods text.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "busco-phylogeny" from https://skillstore.io/skills/brunoasm-busco-phylogeny.md and its manifest at https://skillstore.io/api/skills/brunoasm-busco-phylogeny/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "busco-phylogeny". Build a local workflow for 12 fungal genomes with 24 CPUs and the fungi BUSCO lineage.
Expected outcome:
A staged local workflow covers environment setup, compleasm runs, QC, ortholog extraction, MAFFT alignment, trimming, IQ-TREE inference, ASTRAL, and methods text.
Using "busco-phylogeny". Find chromosome-level RefSeq assemblies for Felidae and show contig N50 values.
Expected outcome:
A ranked assembly table presents accessions, organism names, assembly levels, annotation status, and contig N50 values for selection.
Using "busco-phylogeny". Prepare SLURM jobs for 40 insect genomes with 128 CPUs and 16 CPUs per compleasm job.
Expected outcome:
Scheduler-ready stages include the first lineage-download job, parallel genome arrays, locus arrays, resource settings, logs, and downstream dependencies.
Security Audit
High Riskv9 • 7/23/2026 Open versioned report
Most static matches are benign workflow syntax, documentation markup, fixed relative paths, or safe argument-list subprocess calls. Confirmed risks include eval-based command injection, unverified executable downloads, and predictable shared temporary directories. No prompt injection, credential collection, or data-exfiltration intent was found. Static review was capped at 400/549 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
29
Files scanned
8,659
Lines analyzed
32
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Command Injection Through Eval
run_aliscore.sh concatenates user-controlled option values and an alignment basename into ALISCORE_CMD, then executes the string with eval. A crafted -o, -t, -w, -r, or filename value can run arbitrary shell commands.
The option parser directly appends positional values to a command string, and line 217 passes that string to eval. Shell metacharacters in those values are therefore interpreted as commands.
Capability review items (32)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
GITHUB_BASE="https://raw.githubusercontent.com/brunoasm/my_claude_skills/main/phylo_from_buscos/scri
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
if wget -q https://github.com/PatrickKueck/AliCUT/raw/master/Aliscore_v.2.0/Aliscore.02.2.pl -O scri
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget -q https://github.com/PatrickKueck/AliCUT/raw/master/ALICUT_V2.3.1/ALICUT_V2.31.pl -O scripts/A
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget -q https://github.com/PatrickKueck/AliCUT/raw/master/Aliscore_v.2.0/Aliscore_module.pm -O scrip
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget https://raw.githubusercontent.com/PatrickKueck/AliCUT/master/Aliscore.02.2.pl
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget https://raw.githubusercontent.com/PatrickKueck/AliCUT/master/Aliscore_module.pm
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget https://raw.githubusercontent.com/PatrickKueck/AliCUT/master/ALICUT_V2.31.pl
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget https://raw.githubusercontent.com/PatrickKueck/FASconCAT-G/master/FASconCAT-G_v1.06.1.pl
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
High
Hardcoded URL
wget https://github.com/iqtree/iqtree2/releases/download/v2.3.6/iqtree-2.3.6-Linux-intel.tar.gz
The instructions download an executable archive or installer without a checksum or signature before installation or execution. Compromise of the hosted artifact would allow code execution in the user's environment.
High
Hardcoded URL
wget https://github.com/iqtree/iqtree2/releases/download/v2.3.6/iqtree-2.3.6-macOS-intel.tar.gz
The instructions download an executable archive or installer without a checksum or signature before installation or execution. Compromise of the hosted artifact would allow code execution in the user's environment.
High
Hardcoded URL
wget https://github.com/iqtree/iqtree2/releases/download/v2.3.6/iqtree-2.3.6-macOS-arm.tar.gz
The instructions download an executable archive or installer without a checksum or signature before installation or execution. Compromise of the hosted artifact would allow code execution in the user's environment.
High
Hardcoded URL
wget https://github.com/smirarab/ASTRAL/raw/master/Astral.5.7.8.zip
The instructions download an executable archive or installer without a checksum or signature before installation or execution. Compromise of the hosted artifact would allow code execution in the user's environment.
High
Hardcoded URL
wget https://github.com/conda-forge/miniforge/releases/latest/download/Miniforge3-Linux-x86_64.sh
The instructions download an executable archive or installer without a checksum or signature before installation or execution. Compromise of the hosted artifact would allow code execution in the user's environment.
High
Hardcoded URL
wget https://raw.githubusercontent.com/PatrickKueck/FASconCAT-G/master/FASconCAT-G_v1.06.1.pl -O FAS
The instructions download executable Perl code from a repository path without a checksum or signature, then install or run it. A changed or compromised upstream artifact would execute with the user's privileges.
Medium
Temp directory access
mkdir -p /tmp/phylo_downloads
The installation example reuses a predictable shared /tmp directory instead of creating a private directory. This permits local collisions and precreation attacks on installation artifacts.
Medium
Temp directory access
cd /tmp/phylo_downloads
The installation example enters a predictable shared /tmp directory without checking ownership or permissions. Another local process can precreate that path and influence downloaded installation files.
Medium
Temp directory access
rm -rf /tmp/phylo_downloads
The installation example recursively deletes a fixed shared /tmp path. Concurrent runs or a preexisting directory can cause cross-run data loss, so a private mktemp directory is required.
Medium
Temp directory access
mkdir -p /tmp/phylo_downloads
The installation example reuses a predictable shared /tmp directory instead of creating a private directory. This permits local collisions and precreation attacks on installation artifacts.
Medium
Temp directory access
cd /tmp/phylo_downloads
The installation example enters a predictable shared /tmp directory without checking ownership or permissions. Another local process can precreate that path and influence downloaded installation files.
Medium
Temp directory access
rm -rf /tmp/phylo_downloads
The installation example recursively deletes a fixed shared /tmp path. Concurrent runs or a preexisting directory can cause cross-run data loss, so a private mktemp directory is required.
Medium
Temp directory access
mkdir -p /tmp/phylo_downloads
The installation example reuses a predictable shared /tmp directory instead of creating a private directory. This permits local collisions and precreation attacks on installation artifacts.
Medium
Temp directory access
cd /tmp/phylo_downloads
The installation example enters a predictable shared /tmp directory without checking ownership or permissions. Another local process can precreate that path and influence downloaded installation files.
Medium
Temp directory access
rm -rf /tmp/phylo_downloads
The installation example recursively deletes a fixed shared /tmp path. Concurrent runs or a preexisting directory can cause cross-run data loss, so a private mktemp directory is required.
Medium
Temp directory access
mkdir -p /tmp/phylo_downloads
The installation example reuses a predictable shared /tmp directory instead of creating a private directory. This permits local collisions and precreation attacks on installation artifacts.
Medium
Temp directory access
cd /tmp/phylo_downloads
The installation example enters a predictable shared /tmp directory without checking ownership or permissions. Another local process can precreate that path and influence downloaded installation files.
Medium
Temp directory access
rm -rf /tmp/phylo_downloads
The installation example recursively deletes a fixed shared /tmp path. Concurrent runs or a preexisting directory can cause cross-run data loss, so a private mktemp directory is required.
Medium
Temp directory access
mkdir -p /tmp/phylo_downloads
The installation example reuses a predictable shared /tmp directory instead of creating a private directory. This permits local collisions and precreation attacks on installation artifacts.
Medium
Temp directory access
cd /tmp/phylo_downloads
The installation example enters a predictable shared /tmp directory without checking ownership or permissions. Another local process can precreate that path and influence downloaded installation files.
Medium
Temp directory access
rm -rf /tmp/phylo_downloads
The installation example recursively deletes a fixed shared /tmp path. Concurrent runs or a preexisting directory can cause cross-run data loss, so a private mktemp directory is required.
Medium
Temp directory access
mkdir -p /tmp/phylo_downloads
The installation example reuses a predictable shared /tmp directory instead of creating a private directory. This permits local collisions and precreation attacks on installation artifacts.
Medium
Temp directory access
cd /tmp/phylo_downloads
The installation example enters a predictable shared /tmp directory without checking ownership or permissions. Another local process can precreate that path and influence downloaded installation files.
Medium
Temp directory access
rm -rf /tmp/phylo_downloads
The installation example recursively deletes a fixed shared /tmp path. Concurrent runs or a preexisting directory can cause cross-run data loss, so a private mktemp directory is required.
Risk Factors
⚙️ External commands (50)
references/REFERENCE.md:2204 references/REFERENCE.md:2219-2221 references/REFERENCE.md:89 references/REFERENCE.md:195 references/REFERENCE.md:219 references/REFERENCE.md:748 references/REFERENCE.md:752 references/REFERENCE.md:953 references/REFERENCE.md:958 references/REFERENCE.md:1010 references/REFERENCE.md:1180 references/REFERENCE.md:1357 references/REFERENCE.md:1481 references/REFERENCE.md:1482 references/REFERENCE.md:1512 references/REFERENCE.md:1513 references/REFERENCE.md:1543 references/REFERENCE.md:1544 references/REFERENCE.md:1567 references/REFERENCE.md:1579 references/REFERENCE.md:1614 references/REFERENCE.md:1651 references/REFERENCE.md:1652 references/REFERENCE.md:1677 references/REFERENCE.md:1678 references/REFERENCE.md:1694 references/REFERENCE.md:1716 references/REFERENCE.md:1750 references/REFERENCE.md:1751 references/REFERENCE.md:1772 references/REFERENCE.md:1773 references/REFERENCE.md:1788 references/REFERENCE.md:1812 references/REFERENCE.md:1813 references/REFERENCE.md:1828 references/REFERENCE.md:1851 references/REFERENCE.md:1852 references/REFERENCE.md:1867 references/REFERENCE.md:2006 references/REFERENCE.md:2007 references/REFERENCE.md:2039 references/REFERENCE.md:2040 references/REFERENCE.md:2068 references/REFERENCE.md:2098 references/REFERENCE.md:180 references/REFERENCE.md:204 references/REFERENCE.md:228 references/REFERENCE.md:670 references/REFERENCE.md:952 references/REFERENCE.md:957
🌐 Network access (33)
references/REFERENCE.md:685 references/REFERENCE.md:769 references/REFERENCE.md:785 references/REFERENCE.md:786 references/REFERENCE.md:787 references/REFERENCE.md:792 references/REFERENCE.md:934 references/REFERENCE.md:935 references/REFERENCE.md:938 references/REFERENCE.md:998 references/REFERENCE.md:1045 references/REFERENCE.md:1070 references/REFERENCE.md:1095 references/REFERENCE.md:1133 references/REFERENCE.md:1303 references/REFERENCE.md:2177 references/REFERENCE.md:2179 references/REFERENCE.md:2181 references/REFERENCE.md:2183 references/REFERENCE.md:2185 references/REFERENCE.md:2187 references/REFERENCE.md:2189 references/REFERENCE.md:2191 references/REFERENCE.md:2193 references/REFERENCE.md:2195 references/REFERENCE.md:2197 scripts/query_ncbi_assemblies.py:6 scripts/query_ncbi_assemblies.py:24 scripts/run_alicut.sh:35 scripts/run_aliscore.sh:40 SKILL.md:212 SKILL.md:284 SKILL.md:515
📁 Filesystem access (50)
references/REFERENCE.md:518 references/REFERENCE.md:1649 references/REFERENCE.md:1656 references/REFERENCE.md:1675 references/REFERENCE.md:1680 references/REFERENCE.md:1691 references/REFERENCE.md:1697 references/REFERENCE.md:1711 references/REFERENCE.md:1718 references/REFERENCE.md:1747 references/REFERENCE.md:1753 references/REFERENCE.md:1769 references/REFERENCE.md:1775 references/REFERENCE.md:1785 references/REFERENCE.md:1789 references/REFERENCE.md:1810 references/REFERENCE.md:1815 references/REFERENCE.md:1825 references/REFERENCE.md:1829 references/REFERENCE.md:1849 references/REFERENCE.md:1854 references/REFERENCE.md:1864 references/REFERENCE.md:1868 references/REFERENCE.md:191 references/REFERENCE.md:215 references/REFERENCE.md:231 references/REFERENCE.md:1475 references/REFERENCE.md:1508 references/REFERENCE.md:1535 references/REFERENCE.md:1562 references/REFERENCE.md:1608 references/REFERENCE.md:1645 references/REFERENCE.md:1672 references/REFERENCE.md:1687 references/REFERENCE.md:1707 references/REFERENCE.md:1743 references/REFERENCE.md:1766 references/REFERENCE.md:1781 references/REFERENCE.md:1806 references/REFERENCE.md:1821 references/REFERENCE.md:1845 references/REFERENCE.md:1860 references/REFERENCE.md:1889 references/REFERENCE.md:1925 references/REFERENCE.md:1946 references/REFERENCE.md:2000 references/REFERENCE.md:2034 references/REFERENCE.md:2056 references/REFERENCE.md:2090 references/REFERENCE.md:191
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/brunoasm-busco-phylogeny/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/brunoasm-busco-phylogeny?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/brunoasm-busco-phylogeny?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brunoasm-busco-phylogeny/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/brunoasm-busco-phylogeny.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
brunoasm. (2026). busco-phylogeny security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brunoasm-busco-phylogeny/audits/9BibTeX citation
@techreport{brunoasm-brunoasm-busco-phylogeny-2026,
author = {brunoasm},
title = {busco-phylogeny security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/brunoasm-busco-phylogeny/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "busco-phylogeny security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "brunoasm"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brunoasm-busco-phylogeny/audits/9"
identifiers:
- type: other
value: "skillstore:brunoasm-busco-phylogeny:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 77
Architecture
85
Maintainability
87
Content
70
Community
74
Spec Compliance
What You Can Build
Plan a Comparative Genomics Study
Turn selected genome assemblies into a documented ortholog, alignment, trimming, and tree-inference workflow.
Prepare Cluster Jobs
Generate resource-aware SLURM or PBS scripts with array jobs for large genome and locus collections.
Learn Phylogenomics
Follow each genome-to-tree stage with quality thresholds, method choices, expected outputs, and publication guidance.
Try These Prompts
Create a Local Workflow
Create a local BUSCO phylogeny workflow for [taxon] using [genome paths]. Ask for missing lineage, CPU, memory, and trimming choices.
Select NCBI Assemblies
Find up to [count] NCBI assemblies for [taxon]. Prioritize [quality criteria], show quality metrics, and prepare selected accessions for download.
Generate Cluster Scripts
Generate SLURM scripts for [genome count] genomes using [BUSCO lineage], [CPU count] CPUs, [memory], and [walltime]. Use array jobs where appropriate.
Design and Validate an Analysis
Design and validate a complete workflow for [taxon]. Compare [trimming methods], test [model set], infer concatenated and ASTRAL trees, and draft methods text.
Best Practices
- Review generated paths, resource requests, software versions, and scheduler directives before execution.
- Use consistent sample names and retain accession mappings, QC reports, logs, parameters, and intermediate files.
- Pin and verify downloaded tools, then test the workflow on a small genome subset before scaling.
Avoid
- Do not mix unrelated BUSCO lineages or inconsistent assembly-quality thresholds without documenting the rationale.
- Do not submit large job arrays before validating one genome and one locus end to end.
- Do not run mutable downloaded scripts or installers without version pinning and integrity verification.
Frequently Asked Questions
What inputs are required?
Provide local genome FASTA paths, NCBI assembly accessions, BioProject accessions, or a combination of these inputs.
Which execution environments are supported?
The templates support local Bash, GNU parallel, SLURM, and PBS/Torque workflows.
Does the skill download data or software?
Optional steps use the NCBI datasets CLI and may retrieve scientific tools or reference data from external sources.
How is the BUSCO lineage selected?
Choose the narrowest appropriate OrthoDB lineage that covers the study taxa, then confirm availability in compleasm.
Which trimming methods are available?
The workflow supports trimAl, ClipKit, BMGE, and Aliscore with ALICUT.
What final outputs are produced?
Outputs include QC summaries, alignments, a supermatrix, partition definitions, gene trees, concatenated trees, an ASTRAL tree, and methods text.
Developer Details
Author
brunoasmLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
9 downloads · 227 views
File structure