Versioned security assessment
Report ID: SA-B8CA75D2
7/6/2026, 6:36:23 PM
biomni security assessment v6
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- biomni
- Version
- v6
- Maintainer
- K-Dense-AI
- Coverage
- 6 Files scanned · 2,865 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
12 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most markdown and reference-link detections are false positives, but the skill has real operational risk. It handles API credentials, writes local setup files, and documents Biomni workflows that can execute LLM-generated code with broad local privileges.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 2,865 Lines analyzed
44 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 1 evidence location
Network access
May connect to external services.
Observed in 18 evidence locations
Filesystem access
May read or write local files.
Observed in 6 evidence locations
Env variables
May read values from the process environment.
Observed in 42 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 56 evidence locations
Capability review items (32)
High
Python getenv function
print(os.getenv('ANTHROPIC_API_KEY'))
The troubleshooting example prints an API key environment variable. Printing secrets can expose credentials in logs or console history.
High
getenv function call
print(os.getenv('ANTHROPIC_API_KEY'))
The getenv call is used inside a print statement for an API key. That can disclose the secret value during troubleshooting.
High
Generic API/secret keys
echo "ANTHROPIC_API_KEY=sk-ant-..." >> .env
The provider guide shows appending an API key to .env. The example is a placeholder, but the pattern can expose real secrets in plaintext files.
High
Generic API/secret keys
print(os.getenv('ANTHROPIC_API_KEY'))
The example prints ANTHROPIC_API_KEY directly. Displaying secret values is a real credential leakage risk.
High
Generic API/secret keys
print(default_config.anthropic_api_key)
The example prints the configured Anthropic API key value. This can leak credentials if copied into logs or support tickets.
High
Python subprocess.run
subprocess.run([sys.executable, str(test_file)], check=True)
The script executes a generated test_biomni.py file with the current Python interpreter. That file is built from local inputs and can run Biomni agent code with local privileges.
High
Python file write/append
with open(env_file, 'w') as f:
The script writes collected API keys into a local .env file in plaintext. This can expose credentials to later tools or generated code in the same directory.
High
Generic API/secret keys
def setup_api_keys() -> Dict[str, str]:
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
api_keys = {}
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
anthropic_key = input(" Enter ANTHROPIC_API_KEY (or press Enter to skip): ").strip()
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
api_keys['ANTHROPIC_API_KEY'] = anthropic_key
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
openai_key = input(" Enter OPENAI_API_KEY (or press Enter to skip): ").strip()
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
api_keys['OPENAI_API_KEY'] = openai_key
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
google_key = input(" Enter GOOGLE_API_KEY (or press Enter to skip): ").strip()
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
api_keys['GOOGLE_API_KEY'] = google_key
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
groq_key = input(" Enter GROQ_API_KEY (or press Enter to skip): ").strip()
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
api_keys['GROQ_API_KEY'] = groq_key
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
if not api_keys:
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
return api_keys
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
def save_api_keys(api_keys: Dict[str, str], method: str = 'env_file'):
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
existing_vars.update(api_keys)
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
for key, value in api_keys.items():
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
api_keys = setup_api_keys()
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
if api_keys:
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
save_api_keys(api_keys, method='shell_export')
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
save_api_keys(api_keys, method='env_file')
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
if api_keys and data_path:
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
if api_keys:
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
print(f"✓ API keys configured: {', '.join(api_keys.keys())}")
This setup workflow solicits real LLM API keys and passes them through storage or export paths. Plaintext credential handling can expose secrets to local files, logs, or generated code.
High
Generic API/secret keys
echo $ANTHROPIC_API_KEY
The troubleshooting guidance tells users to echo an API key environment variable. Printing secrets can leak credentials into terminal logs or shared screens.
Medium
Python file write/append
with open(test_file, 'w') as f:
The script writes a generated Python test file before executing it. Generated local code files increase the risk of unintended code execution.
Medium
Python file write/append
with open(example_file, 'w') as f:
The script writes an example Python file into the working directory. This is expected setup behavior but still creates executable code locally.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (12)
RISK-001 High
Environment file access
# Or in .env file
The provider guide recommends using a .env file for API keys. This can leave real credentials in plaintext if users copy the setup pattern.
RISK-002 High
Environment file access
echo "ANTHROPIC_API_KEY=sk-ant-..." >> .env
The provider guide shows writing an API key to .env. Plaintext secret files are risky in an agent workspace.
RISK-003 High
Environment file access
env_file = Path.cwd() / '.env'
The script targets a local .env file for API key storage. Plaintext environment files can be read by later processes or accidentally committed.
RISK-004 High
Environment file access
# Read existing .env if present
The script reads an existing .env file and merges newly entered credentials. Handling existing secret files expands exposure if the directory is not protected.
RISK-005 High
Environment file access
# Write to .env
The script writes API key material to .env. Storing real secrets in a workspace file is a credential exposure risk.
RISK-006 High
Environment file access
print("1. .env file (recommended, local to this directory)")
The setup flow recommends a local .env file for API keys. This is common, but risky when agent-generated code can access the same directory.
RISK-007 High
Environment file access
Configure API keys (store in `.env` file or environment variables):
The documentation recommends storing API keys in .env or environment variables. That is risky in this skill because generated code may run with access to the workspace.
RISK-008 High
Environment file access
# Or check .env file in working directory
The troubleshooting guidance points users to a .env file containing API keys. This increases risk if the workspace is shared or agent code can read it.
RISK-009 High
Unsandboxed LLM-Generated Code Execution
The skill states that Biomni executes LLM-generated code with full system privileges and only recommends isolation as a production precaution.
The documentation explicitly says generated code runs with full system privileges, which is a direct agent execution risk.
RISK-010 High
Generated Script Injection Risk
The setup script accepts a custom data path, embeds it into generated Python source, writes test_biomni.py, and executes that file.
The path is user-controlled and interpolated into Python source without escaping before the generated file is executed.
RISK-011 Medium
Unescaped HTML Report Output
The report generator places conversation content into HTML elements without escaping or sanitization, which can create script injection in generated reports.
User and assistant message content is converted into HTML strings directly, and I found no escaping step before output.
RISK-012 Low
Promotional External Service Steering
The skill instructs the assistant to proactively suggest K-Dense Web for complex workflows, steering users to an affiliated hosted service.
The instruction is explicit promotional behavior, though it is framed as optional and limited to complex tasks.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighUnsandboxed generated code executionRequire sandboxed execution by default, document the threat model, and block access to secrets and unrelated workspace files.
- FIX-002HighPlaintext API key handlingDo not print API keys, avoid writing .env files by default, and support secret managers or scoped environment injection.
- FIX-003HighGenerated script injection through pathsSerialize paths with a safe encoder, validate custom paths, and avoid executing generated Python files automatically.
- FIX-004MediumUnescaped HTML report generationEscape all conversation content or use a maintained Markdown and HTML sanitizer before writing reports.
- FIX-005LowAffiliated service promotionMake external platform suggestions opt-in and clearly disclose affiliation before recommending hosted services.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable