biopython

SAFE max severity MEDIUMSkillSpector Caution 0 registry K-Dense-AI last scanned 2026-10-21 1 scan

Verdict safe, but 6 findings (6 medium), mainly command injection. Most recent scan 2026-10-21.

Findings6

Critical0

High0

Medium6

Low0

Analyzersstatic bytecode pipeline correlation behavioral trigger

Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 0

Score0 / 100

Issues0

Version2.12.0 (static)

SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Provides Biopython workflows for sequence manipulation, file parsing (FASTA/GenBank/PDB), phylogenetics, and programmatic NCBI/PubMed access (Bio.Entrez). Supports batch processing, custom molecular-biology pipelines, BLAST automation, structure analysis, and motif analysis.

Package: 9 files, 112 KB
SKILL.md: 1989 words, 12+ sections
Code: None. Instructions only.
Allowed tools: Read Write Edit Bash
License: Biopython License Agreement
Compatibility: Requires Python 3.10+, NumPy, and Biopython 1.88. Optional plotting requires Matplotlib or ReportLab. Entrez and web BLAST require network access and a contact email; local BLAST, MUSCLE 5, Clustal Omega, and DSSP require separate executables.

SKILL.md covers: Biopython: Computational Molecular Biology in Python · Overview · When to Use This Skill · Core Capabilities · Installation and Setup · Optional: register at https://www.ncbi.nlm.nih.gov/account/settings/ · Using This Skill · 1. Sequence Handling (Bio.Seq & Bio.SeqIO) · Read sequences from FASTA file · Convert GenBank to FASTA · 2. Alignment Analysis (Bio.Align & Bio.AlignIO) · Pairwise alignment

Findings

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in references/alignment.md at line 295 contains potentially dangerous Python code.

references/alignment.md:295

subprocess.run(cmd, check=True)

Remediation: Review the code block for security implications.

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in references/alignment.md at line 313 contains potentially dangerous Python code.

references/alignment.md:313

subprocess.run(cmd, check=True)

Remediation: Review the code block for security implications.

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in references/blast.md at line 204 contains potentially dangerous Python code.

references/blast.md:204

subprocess.run(cmd, check=True)

Remediation: Review the code block for security implications.

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in references/blast.md at line 231 contains potentially dangerous Python code.

references/blast.md:231

subprocess.run(cmd, check=True)

Remediation: Review the code block for security implications.

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in references/blast.md at line 320 contains potentially dangerous Python code.

references/blast.md:320

subprocess.run(cmd, check=True)

Remediation: Review the code block for security implications.

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in references/blast.md at line 349 contains potentially dangerous Python code.

references/blast.md:349

subprocess.run(cmd, check=True)

Remediation: Review the code block for security implications.

What is in the package

File	Kind	Size
`SKILL.md`	doc	17 KB
`references/advanced.md`	doc	16 KB
`references/alignment.md`	doc	9.7 KB
`references/blast.md`	doc	14 KB
`references/databases.md`	doc	13 KB
`references/phylogenetics.md`	doc	15 KB
`references/review.md`	doc	6.2 KB
`references/sequence_io.md`	doc	8.0 KB
`references/structure.md`	doc	13 KB

External hosts referenced

biopython.org github.com blast.ncbi.nlm.nih.gov www.ncbi.nlm.nih.gov arxiv.org pypi.org doi.org eutils.ncbi.nlm.nih.gov export.arxiv.org ncbiinsights.ncbi.nlm.nih.gov www.drive5.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

NCBI_API_KEY

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Bytecode analyzer.
Pipeline analyzer.
Correlation analyzer.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/K-Dense-AI/scientific-agent-skills
Raw scan result: skills-biopython-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/k-dense-ai-biopython.svg)
Request a re-scan