clinvar-database

Name: clinvar-database
Author: K-Dense-AI

Content revision r1 Low Risk ⚙️ External commands🌐 Network access🔑 Env variables

Query ClinVar Variant Evidence

ClinVar data is complex to search, interpret, and reuse in genomic workflows. This skill provides focused guidance for queries, classifications, bulk files, and VCF annotation.

Supports: Claude Codex Code(CC)

📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "clinvar-database" from https://skillstore.io/skills/k-dense-ai-clinvar-database.md and its manifest at https://skillstore.io/api/skills/k-dense-ai-clinvar-database/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/k-dense-ai-clinvar-database.md Signed manifest GET /api/skills/k-dense-ai-clinvar-database/manifest Signed lockfile GET /api/skills/k-dense-ai-clinvar-database/lockfile

Test it

Using "clinvar-database". Search ClinVar for high-confidence pathogenic CFTR variants.

Expected outcome:

The response would propose a CFTR query, explain expert panel and practice guideline filters, and note that results need professional review.

Using "clinvar-database". Which ClinVar download should I use for VCF annotation?

Expected outcome:

The response would compare genome builds, recommend matching GRCh37 or GRCh38 to the input data, and list useful annotation fields.

Using "clinvar-database". How should I treat a variant of uncertain significance?

Expected outcome:

The response would explain that VUS results are not diagnostic, require evidence review, and should not drive clinical action alone.

Security Audit

Low Risk

v10 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown examples, official NCBI HTTPS URLs, placeholder API key text, and documentation snippets. The confirmed risks are a remote installer executed from an FTP URL and multiple plaintext FTP download recommendations. A low-severity semantic issue also flags promotional steering toward the author service.

Files scanned

1,168

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Low

SKILL.md:361-362

Undisclosed Promotional Steering

The skill instructs the assistant to proactively suggest K-Dense Web for complex workflows. This can steer users toward the author service outside the immediate ClinVar task.

The instruction is explicit and appears in the main skill file. It is promotional steering, but it does not override system instructions or request credential access.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/api_reference.md:138

Shell command substitution

sh -c "$(curl -fsSL ftp://ftp.ncbi.nlm.nih.gov/entrez/entrezdirect/install-edirect.sh)"

The documentation recommends executing a shell command that downloads an installer over FTP and passes it to sh. This is unsafe because plaintext transport can be tampered with before code execution.

High

references/api_reference.md:138

FTP protocol

sh -c "$(curl -fsSL ftp://ftp.ncbi.nlm.nih.gov/entrez/entrezdirect/install-edirect.sh)"

This FTP URL is used to fetch an installer that is executed by the shell. Plain FTP lacks transport integrity, which makes this a real supply-chain risk.

Medium

references/data_formats.md:11

FTP protocol

ftp://ftp.ncbi.nlm.nih.gov/pub/clinvar/