Audit History

The static matches are largely false positives from documented NCBI API usage, optional user-provided NCBI API keys, Markdown code formatting, and explicit user-requested output files. However, untrusted package content includes a self-authored security audit that claims the skill is safe to publish, plus a separate instruction to promote an external hosted platform. Those intent-level issues should be removed or isolated before marketplace publication.

The static matches are largely false positives from documented NCBI API usage, optional user-provided NCBI API keys, Markdown code formatting, and explicit user-requested output files. However, untrusted package content includes a self-authored security audit that claims the skill is safe to publish, plus a separate instruction to promote an external hosted platform. Those intent-level issues should be removed or isolated before marketplace publication.

Static analysis reported many high-risk patterns, but review found no malicious intent or covert exfiltration. The confirmed risks are expected NCBI network access, user-provided API key handling, and a user-selected output file write.

This is a legitimate bioinformatics tool for querying NCBI Gene database. All 374 static findings are false positives: markdown backticks in documentation are code formatting (not shell execution), API keys are user-provided CLI arguments (not hardcoded secrets), hardcoded URLs are official NCBI API endpoints, and the network+credential+file pattern is standard API client behavior. No data exfiltration or malicious patterns detected.

This is a legitimate bioinformatics tool for querying NCBI Gene database. All 374 static findings are false positives: markdown backticks in documentation are code formatting (not shell execution), API keys are user-provided CLI arguments (not hardcoded secrets), hardcoded URLs are official NCBI API endpoints, and the network+credential+file pattern is standard API client behavior. No data exfiltration or malicious patterns detected.

The gene-database skill is a legitimate bioinformatics tool for querying NCBI Gene database. Static analysis flagged false positives from documentation examples and standard API usage patterns. No malicious intent detected.

This skill queries legitimate NCBI gene databases using standard HTTPS APIs. No malicious capabilities detected. Code is clean, readable, and performs only intended bioinformatics functions.