📦

biomni

Name: biomni
Author: davila7

Content revision r2 Critical ⚡ Contains scripts📁 Filesystem access🔑 Env variables🌐 Network access⚙️ External commands

Run Biomedical Research Workflows

Complex biomedical analyses require coordinated reasoning, data access, and reproducible reporting. Biomni guides an autonomous agent through these multi-step research workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "biomni" from https://skillstore.io/skills/davila7-biomni.md and its manifest at https://skillstore.io/api/skills/davila7-biomni/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-biomni.md Signed manifest GET /api/skills/davila7-biomni/manifest Signed lockfile GET /api/skills/davila7-biomni/lockfile

Test it

Using "biomni". Prioritize genes for an autophagy CRISPR screen in HEK293 cells.

Expected outcome:

Ranked gene candidates with pathway and essentiality evidence.
Screen controls, selection strategy, and expected technical limitations.
Validation experiments for the strongest candidates.

Using "biomni". Interpret significant variants from a disease GWAS summary file.

Expected outcome:

Variant-to-gene mapping with supporting evidence.
Enriched pathways and plausible disease mechanisms.
Uncertainty notes and recommended follow-up analyses.

Using "biomni". Compare ADMET properties for a small set of candidate compounds.

Expected outcome:

A comparative property summary for absorption, distribution, metabolism, excretion, and toxicity.
Risk flags, evidence limitations, and priorities for experimental testing.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most scanner hits are Markdown formatting, placeholder credentials, documentation links, or fixed subprocess calls. Confirmed issues include credential exposure, unsafe secret storage, generated-code injection, unescaped HTML, unpinned package execution, and full-privilege LLM code execution.

Files scanned

2,860

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (12)

Critical

SKILL.md:228-233 references/api_reference.md:67-71

Unsandboxed LLM-Generated Code Execution

The skill states that Biomni executes LLM-generated code with full system privileges. Prompt or data manipulation could therefore become arbitrary host code execution.

The documentation explicitly states full-privilege generated-code execution and describes generation and execution as standard agent behavior.

High

references/llm_providers.md:29

Environment file access

# Or in .env file

The guide recommends storing an API key in a local .env file without requiring restrictive permissions or exclusion from version control.

High

references/llm_providers.md:30

Environment file access

echo "ANTHROPIC_API_KEY=sk-ant-..." >> .env

The shell command appends a credential to .env without setting file permissions. A substituted live key can become readable or accidentally committed.

High

scripts/setup_environment.py:128

Environment file access

env_file = Path.cwd() / '.env'

The path targets .env for credential storage. New files use ambient umask permissions, and the script applies no explicit owner-only mode.

High

scripts/setup_environment.py:130

Environment file access

# Read existing .env if present

The script reads every existing .env value and later rewrites the file alongside newly collected credentials.

High

scripts/setup_environment.py:144

Environment file access

# Write to .env

The following write stores API keys in plaintext .env content without restricting file permissions.

High

scripts/setup_environment.py:298

Environment file access

print("1. .env file (recommended, local to this directory)")

The setup recommends local .env storage but does not mention owner-only permissions or mandatory version-control exclusion.

High

SKILL.md:41

Environment file access

Configure API keys (store in `.env` file or environment variables):

The instructions recommend .env credential storage without requiring restrictive permissions or version-control exclusion.

Show all 12 confirmed findings

High

SKILL.md:290

Environment file access

# Or check .env file in working directory

The troubleshooting guidance directs users to inspect a credential-bearing .env file, increasing accidental display or support-log disclosure risk.

High

scripts/setup_environment.py:174-176 scripts/setup_environment.py:199-219

Custom Path Enables Generated Python Injection

A user-supplied data path is interpolated without escaping into generated Python source. The setup script then executes that source.

A path containing quotes and newlines can break the Python string, insert statements, and reach the immediate subprocess execution.

High

scripts/generate_report.py:57-63 scripts/generate_report.py:111-117 scripts/generate_report.py:197-254

Stored Script Injection in HTML Reports

Conversation content and report titles enter HTML without escaping. A crafted conversation file can create active script or markup in the generated report.

The converter concatenates untrusted message text into tags and code blocks without HTML escaping or sanitization.

High

references/api_reference.md:351-355

Unpinned MCP Package Executes with an API Key

The MCP example uses npx with automatic approval and no package version. The downloaded package receives the Brave API key and agent privileges.

The documented command executes the latest registry package through npx -y and provides a credential in its environment.

Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/llm_providers.md:363

Python getenv function

print(os.getenv('ANTHROPIC_API_KEY'))

The troubleshooting example reads an API key and prints its value. Following it can expose a live secret in terminals, logs, or recordings.

High

references/llm_providers.md:363

getenv function call

print(os.getenv('ANTHROPIC_API_KEY'))

The getenv call is passed directly to print, disclosing the API key rather than checking only whether it exists.

High

references/llm_providers.md:363

Generic API/secret keys

print(os.getenv('ANTHROPIC_API_KEY'))

This example prints the full ANTHROPIC_API_KEY value. Terminal history, captured output, or support logs could retain the secret.

High

references/llm_providers.md:367

Generic API/secret keys

print(default_config.anthropic_api_key)

The example prints the configured Anthropic API key directly. It should report presence or a masked suffix instead.

High

scripts/setup_environment.py:219

Python subprocess.run

subprocess.run([sys.executable, str(test_file)], check=True)

The subprocess executes test_biomni.py after an unescaped custom data path is interpolated into that file. A crafted path can inject Python statements.

High

scripts/setup_environment.py:145

Python file write/append

with open(env_file, 'w') as f:

The script writes collected API keys to .env as plaintext without creating the file with owner-only permissions.

High

scripts/setup_environment.py:212

Python file write/append

with open(test_file, 'w') as f:

This writes Python source containing an unescaped user-selected path. The generated file is executed immediately on line 219.

High

scripts/setup_environment.py:93

Generic API/secret keys

anthropic_key = input(" Enter ANTHROPIC_API_KEY (or press Enter to skip): ").strip()

The script collects the Anthropic API key with input(), which echoes the secret on screen instead of using hidden credential input.

High

scripts/setup_environment.py:100

Generic API/secret keys

openai_key = input(" Enter OPENAI_API_KEY (or press Enter to skip): ").strip()

The script collects the OpenAI API key with visible input, exposing it to screen capture and nearby observers.

High

scripts/setup_environment.py:107

Generic API/secret keys

google_key = input(" Enter GOOGLE_API_KEY (or press Enter to skip): ").strip()

The script collects the Google API key with visible input rather than a non-echoing secret prompt.

High

scripts/setup_environment.py:114

Generic API/secret keys

groq_key = input(" Enter GROQ_API_KEY (or press Enter to skip): ").strip()

The script collects the Groq API key with visible input rather than a non-echoing secret prompt.

High

scripts/setup_environment.py:142

Generic API/secret keys

existing_vars.update(api_keys)

Collected API keys are merged into variables that are written to a plaintext .env file without an owner-only permission step.

High

scripts/setup_environment.py:158

Generic API/secret keys

for key, value in api_keys.items():

The loop sends each key value to print on line 159. Selecting shell export therefore discloses every collected credential on screen.

High

scripts/setup_environment.py:304

Generic API/secret keys

save_api_keys(api_keys, method='shell_export')

This branch calls shell_export, whose implementation prints each raw credential value to the terminal.

High

scripts/setup_environment.py:306

Generic API/secret keys

save_api_keys(api_keys, method='env_file')

This branch persists collected credentials in a plaintext .env file without enforcing owner-only permissions.

High

SKILL.md:289

Generic API/secret keys

echo $ANTHROPIC_API_KEY

The troubleshooting command echoes the full Anthropic API key, which can expose it in terminal output or captured logs.

Medium

scripts/setup_environment.py:273

Python file write/append

with open(example_file, 'w') as f:

This writes an example Python file containing an unescaped custom path. Running the generated example can execute path-injected statements.

Risk Factors

⚡ Contains scripts (1)

references/api_reference.md:385-391

📁 Filesystem access (6)

references/api_reference.md:47 references/api_reference.md:369 scripts/setup_environment.py:299 scripts/setup_environment.py:145 scripts/setup_environment.py:212 scripts/setup_environment.py:273

🔑 Env variables (44)

🌐 Network access (20)

⚙️ External commands (50)

scripts/generate_report.py:63 scripts/generate_report.py:69-71 scripts/generate_report.py:71-88 scripts/generate_report.py:88 scripts/setup_environment.py:25 scripts/setup_environment.py:47 scripts/setup_environment.py:67 scripts/setup_environment.py:219 SKILL.md:37-39 SKILL.md:39-41 SKILL.md:41-42 SKILL.md:42-45 SKILL.md:45-47 SKILL.md:47-51 SKILL.md:51-62 SKILL.md:62-70 SKILL.md:70-84 SKILL.md:84-87 SKILL.md:87 SKILL.md:88 SKILL.md:90-91 SKILL.md:91-94 SKILL.md:94-100 SKILL.md:100-120 SKILL.md:120-125 SKILL.md:125-133 SKILL.md:133-136 SKILL.md:136-145 SKILL.md:145-148 SKILL.md:148-159 SKILL.md:159-162 SKILL.md:162-171 SKILL.md:171-173 SKILL.md:173-184 SKILL.md:184-190 SKILL.md:190-198 SKILL.md:198-204 SKILL.md:204-218 SKILL.md:218-237 SKILL.md:237-238 SKILL.md:238-242 SKILL.md:242-251 SKILL.md:251-256 SKILL.md:256-258 SKILL.md:258-259 SKILL.md:259-260 SKILL.md:260-263 SKILL.md:263-265 SKILL.md:265-266 SKILL.md:266-280

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-biomni/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-biomni/security.svg)](https://skillstore.io/skills/davila7-biomni?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-biomni?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-biomni/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-biomni.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). biomni security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-biomni/audits/9

BibTeX citation

@techreport{davila7-davila7-biomni-2026,
  author = {davila7},
  title = {biomni security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/davila7-biomni/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "biomni security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-biomni/audits/9"
identifiers:
  - type: other
    value: "skillstore:davila7-biomni:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

davila7 Recommended Current

davila7-biomni

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 19

Updated

2026-09-09

K-Dense-AI

k-dense-ai-biomni

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design Molecular Screens

Develop CRISPR screening strategies, candidate priorities, controls, and validation plans for a defined phenotype.

Analyze Omics Data

Plan quality control, clustering, differential expression, pathway analysis, and interpretation for genomics datasets.

Prioritize Translational Evidence

Combine variants, phenotypes, pathways, and drug evidence to generate reviewable research hypotheses.

Try These Prompts

Summarize a Gene

Summarize the known function of [gene] and list major associated diseases. Cite the databases used and identify uncertain claims.

Compare Expression Groups

Analyze [dataset path] for differential expression between [groups]. Report quality checks, significant genes, methods, and limitations.

Design a CRISPR Screen

Design a CRISPR knockout screen for [phenotype] in [cell type]. Define controls, library strategy, prioritization criteria, and validation steps.

Integrate Causal Evidence

Integrate [GWAS file], [single-cell dataset], and [pathway constraints] to prioritize causal genes. Explain each processing step and uncertainty.

Best Practices

Run Biomni inside an isolated environment and review generated code before execution.
Use deidentified data, least-privilege credentials, and approved provider configurations.
Set task constraints, timeouts, and iteration limits while preserving sources and conversation history.