biopython 审计报告.

警告

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• SKILL.md references `references/sequence_io.md` for sequence handling, but the submitted skill directory only includes `advanced.md`, `alignment.md`, `blast.md`, `databases.md`, and `phylogenetics.md`. The referenced file appears to be missing.
• The NCBI_EMAIL environment variable is listed as optional in metadata, while the documentation correctly states that NCBI policy requires an email for Entrez. The example hardcodes a placeholder instead of reading from the environment, which may cause failed Entrez calls.
• The skill does not include an explicit license/attribution notice beyond the repository license declaration. If the content is derived from Biopython documentation, upstream copyright and license notices should be preserved.
• Permission surface needs review: secrets or environment access, shell or command execution
• Dependency/runtime risk: command execution surface, credential or environment access
• Permission surface: secrets or environment access, shell or command execution

方法

本报告综合公开元数据、AI 审查输出、仓库活跃度、安装就绪度、OpenAgentSkill 事件、质量评分、信任检查和 Agent 安全门槛；它不是完整的源代码安全审计。