genomic-intelligence

ISSUES FOUND max severity HIGHSkillSpector Caution 49 registry K-Dense-AI last scanned 1 scan

3 findings (1 high, 2 medium), mainly data exfiltration. Most recent scan 2026-10-21.

Findings3
Critical0
High1
Medium2
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 49
Score49 / 100
Issues9
CategoriesData Exfiltration analysis-evasion
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Predicts regulatory features, gene structure, and expression directly from DNA sequence using Genomic Intelligence's hosted transformer DNA language models — no local GPU or model weights. Six tasks over a REST API and a hosted MCP server (keyless public demo): promoter regions, splice donor/acceptor sites, enhancer activity, chromatin state, sequence-to-expression (log TPM), and de-novo gene annotation, plus a composite find-genes-then-predict-expression workflow. Use when the user has a gene symbol, a genomic region, or a DNA/FASTA sequence and wants any of these predictions, mentions…

Package
6 files, 61 KB
SKILL.md
3017 words, 12+ sections
Code
None. Instructions only.
License
MIT
Compatibility
Python 3.10+ with the `requests` library for the REST examples. Network access required. The REST `/v1` API needs a `GI_API_KEY` (a `gi_` bearer); the hosted MCP server at mcp.genomicintelligence.ai/mcp works keyless against a rate- and concurrency-limited public demo tier, key optional.

SKILL.md covers: Genomic Intelligence — DNA Sequence Models · When to use this skill · Two ways to call GI · Hosted MCP server (keyless; preferred on MCP hosts) · REST API (universal) · Access and authentication · The six tasks · Sequence acquisition · Core REST workflow · After acquiring and checking an appropriate promoter sequence: · out = predict("promoter", seq, "TP53_region") · print(out["meta"]["task_specific_counts"]["regions_found"])

Findings

HIGH Sensitive source reaches a network sink Data Exfiltrationcorrelation

Correlated sensitive_environment → network behavior across SKILL.md.

SKILL.md:232

Remediation: Remove the transmission or constrain it to explicitly declared, trusted destinations.
MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 213 contains potentially dangerous Python code.

SKILL.md:213

r = requests.post(f"{BASE}/v1/tasks/{task}/predict", headers=HEADERS,
Remediation: Review the code block for security implications.
MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 247 contains potentially dangerous Python code.

SKILL.md:247

r = requests.post(f"{BASE}/v1/tasks/annotation/predict",
Remediation: Review the code block for security implications.

What is in the package

FileKindSize
SKILL.mddoc24 KB
references/api-and-auth.mddoc8.2 KB
references/mcp.mddoc5.9 KB
references/review.mddoc4.1 KB
references/sequence-acquisition.mddoc6.1 KB
references/tasks.mddoc13 KB

External hosts referenced

docs.genomicintelligence.ai api.genomicintelligence.ai rest.ensembl.org mcp.genomicintelligence.ai pypi.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

GI_API_KEY GI_BASE_URL

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills