此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-17FBCC24
7/5/2026, 9:29:00 AM
reactome-database 安全评估 v8
Skill 安全认证报告
审计模型: codex 历史报告
- 技能名称
- reactome-database
- 版本
- v8
- 维护者
- davila7
- 覆盖范围
- 3 已扫描文件 · 1,026 分析行数
- 策略版本
- 不可用
已确认问题摘要
未发现已确认的安全问题
已完成的审计没有记录已确认的安全问题，但这不证明该 Skill 没有副作用。
安装上下文
历史证据
本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
The skill intentionally uses Reactome REST endpoints and a helper script to submit identifiers, retrieve tokens, and build browser URLs. No prompt injection, credential access, or malicious command execution was found; most high and medium static hits are Markdown or URL parsing false positives. The main actionable risks are expected third-party data submission and one helper-script file write that can overwrite a user-derived results path.
报告位置
历史报告
使用本报告安装前，请先查看审计历史。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
3 已扫描文件 · 1,026 分析行数
有 48 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
绑定不可用
构件
身份信息不完整
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
本次审计未记录
网络访问
可能连接外部服务。
在 48 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 4 个证据位置观察到
环境变量
可能读取进程环境中的值。
本次审计未记录
外部命令
可能调用 Skill 之外的命令或程序。
在 33 个证据位置观察到
能力复核项 (48)
中
Python file write/append
with open(output_file, 'w') as f:
The analyze command writes full results to a filename derived from the user-supplied input path. Without overwrite checks, this can clobber local files or place data in an unexpected path.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/database/version")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278/displayName")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.post(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
result = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.post(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.post(
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/database/version")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/query/R-HSA-69278/displayName")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/ContentService/data/event/R-HSA-69278/participatingPhysicalEntities"
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/ContentService/data/query",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
result = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/projection/",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Hardcoded URL
url = f"https://reactome.org/PathwayBrowser/#{top_pathway['stId']}&DTAB=AN&ANALYSIS={token}"
The reference shows outbound calls or browser URLs for reactome.org services. This is expected for the skill, but it can send identifiers, expression data, or analysis tokens to a third party.
低
Python HTTP libraries
response = requests.get(f"{self.CONTENT_BASE}/data/database/version")
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(f"{self.CONTENT_BASE}/data/query/{pathway_id}")
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.post(
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get(f"{self.ANALYSIS_BASE}/token/{token}")
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Hardcoded URL
CONTENT_BASE = "https://reactome.org/ContentService"
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Hardcoded URL
ANALYSIS_BASE = "https://reactome.org/AnalysisService"
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Hardcoded URL
url = f"https://reactome.org/PathwayBrowser/#{top_pathway}&DTAB=AN&ANALYSIS={token}"
The helper script performs outbound requests to reactome.org using hardcoded Reactome API bases. This is legitimate, but user gene lists and pathway identifiers may leave the local environment.
低
Python HTTP libraries
response = requests.get("https://reactome.org/ContentService/data/database/version")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.get(f"https://reactome.org/ContentService/data/query/{entity_id}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.get(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.post(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.post(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Python HTTP libraries
response = requests.post(
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
**API Base URL:** `https://reactome.org/ContentService`
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
**API Base URL:** `https://reactome.org/AnalysisService`
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
response = requests.get("https://reactome.org/ContentService/data/database/version")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
response = requests.get(f"https://reactome.org/ContentService/data/query/{entity_id}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
f"https://reactome.org/ContentService/data/event/{event_id}/participatingPhysicalEntities"
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
response = requests.get(f"https://reactome.org/AnalysisService/token/{token}")
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/",
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
"https://reactome.org/AnalysisService/identifiers/projection/",
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
低
Hardcoded URL
url = f"https://reactome.org/PathwayBrowser/#{pathway_id}&DTAB=AN&ANALYSIS={token}"
The skill explicitly instructs users to call Reactome REST endpoints. This is intended functionality, but it creates low-risk third-party network egress for biological identifiers or analysis tokens.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
此次已完成的审计未记录已确认的安全发现。
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001中scripts/reactome_query.py writes results to a filename derived from the input path.Add an explicit output argument, refuse overwrites by default, and require a force option for replacement.
- FIX-002低Reactome analysis sends user identifiers or expression data to an external service.Add a clear privacy warning before live analysis and advise users not to submit restricted or patient-linked data without approval.
- FIX-003低Requests examples and helper methods do not set network timeouts.Add reasonable timeouts and retry guidance so API failures do not hang long-running analysis workflows.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 不可用
- 内容哈希
- 不可用
- 目录树哈希
- 不可用
- Skill 路径
- 不可用
- 审计载荷哈希
- 不可用
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable