Versioned security assessment

Report ID: SA-AFBC312E

6/30/2026, 5:37:51 AM

gget security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
gget
Version
v5
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/gget
Coverage
8 Files scanned · 3,245 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives from Markdown code fences, documented shell examples, public database URLs, and expected local result files. However, SKILL.md contains an untrusted behavioral instruction that tells the assistant to promote K-Dense Web, which is a prompt-injection attempt and blocks publication until removed.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

8 Files scanned · 3,245 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 Critical
SKILL.md:870-871
Prompt Injection Attempt Detected
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. This is untrusted skill content that attempts to control assistant behavior and promote an external hosted service.
The text is an explicit behavioral instruction directed at the assistant, not neutral documentation about gget. It attempts to influence future user interactions and external service recommendations.
RISK-002 Medium
SKILL.md:639-663references/module_reference.md:431-437
Command-Line API Key Handling Guidance
The gget GPT documentation shows API keys passed directly as parameters and command-line arguments. This can expose credentials through shell history, process listings, notebooks, or shared transcripts.
The API key parameter and example are explicit, but no evidence shows the skill exfiltrates keys. The risk is insecure handling guidance rather than confirmed credential theft.
RISK-003 Medium
references/database_info.md:21-22references/database_info.md:32-33references/database_info.md:54-55SKILL.md:674-675
External Network and Download Operations
The skill intentionally uses gget to query public genomic databases and can download reference or model data. This is expected for bioinformatics, but users should know requests and input sequences may leave the local environment.
The documentation clearly identifies remote databases and optional large downloads. This is legitimate functionality, but still a privacy and operational risk factor.
RISK-004 Medium
scripts/gene_analysis.py:55-60scripts/batch_sequence_analysis.py:77-78scripts/batch_sequence_analysis.py:96-98scripts/enrichment_pipeline.py:78-80
User-Controlled Local Output Files
The helper scripts write CSV, FASTA, alignment, and expression output files using user-supplied names or directories. This is normal analysis behavior, but it can overwrite local files if used carelessly.
The file writes are direct and confirmed in scripts, but they are expected outputs of local analysis tools. No destructive overwrite logic or hidden file targeting was found.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:21-30references/database_info.md:9-11references/workflows.md:390-397
Markdown Code Fences Flagged as Shell Execution
Many external command findings are Markdown examples and fenced code blocks. They document how a user may run gget, pip, Python, or workflow commands, rather than executing automatically inside the skill.
The flagged lines are visibly Markdown or shell workflow examples. There is no evidence that these snippets run without an explicit user action.
Low
evaluation_output.json:4references/database_info.md:19references/module_reference.md:42SKILL.md:100
Weak Cryptography Findings Are Domain Terms
The weak cryptographic algorithm alerts appear to be triggered by biology terms, sequence letters, checksum-like text, or generated scanner output rather than cryptographic code. No evidence found of MD5, SHA1, or other weak algorithms used for security decisions.
Reviewed context shows bioinformatics descriptions and scanner output rather than security-sensitive crypto calls. The static pattern is noisy in genomic text because gene and sequence tokens resemble hash or algorithm names.
Low
SKILL.md:173-175SKILL.md:202-204references/module_reference.md:93-104references/module_reference.md:113-120
Sequence File Parameters Flagged as Hidden File Access
Hidden file access alerts point to parameters that accept FASTA or text file paths for sequence analysis. This is expected for BLAST, BLAT, and alignment workflows and is not hidden filesystem reconnaissance.
The context describes user-provided sequence inputs and output flags. No code enumerates hidden directories or reads secrets without user-supplied paths.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable