Phylo Tree

Generate publication-quality maximum likelihood phylogenetic trees and figures from enzyme names or FASTA sequences with advanced model selection and bootstr...

Recommendations before installing or running: 1) Inspect files that were not fully shown: open generate_feishu_report.py and any other files that mention external services (Feishu, Slack, webhook, api endpoints). If they send data externally, determine whether they require API tokens and where tokens are read from (env vars, config files). Disable/reporting scripts if you do not want automatic sharing. 2) Search the repository for hard-coded absolute paths and URLs: grep for '/root/autodl-tmp', 'http://', 'https://', 'feishu', 'webhook', 'requests', 'socket', and 'base64'. Replace absolute paths with relative ones or confirm they refer only to safe example directories. 3) Prefer offline use: run with --fasta and verify no network activity (e.g., run in an environment with network blocked) to ensure scripts do not make unexpected external calls. 4) Run in a sandboxed or non-root account: create a dedicated conda environment and non-privileged user, inspect and run scripts there first to limit impact on your system and avoid modifications to your main ~/.condarc unless you accept the change. 5) Review run_v2.py and any runner scripts for uses of os.environ, open(...), subprocess with shell=True, or any code that reads credentials or transmits files. Ensure no secrets are exfiltrated. 6) If you plan to use the installation script, read it line-by-line: the provided install script edits ~/.condarc and installs many packages from conda channels — this is expected but be sure you trust the channels and are comfortable with these changes. 7) If you want the community to help verify safety, provide the contents of generate_feishu_report.py, run_v2.py, and any other omitted files; confirmation that no base64-encoded blobs are obfuscated payloads would raise confidence. Why I marked this 'suspicious' (short): most of the behavior is consistent with a phylogenetics tool, but the unexplained Feishu integration, the presence of absolute project paths, and a pre-scan base64 signal are inconsistencies that require manual inspection before trusting or running the skill.

Type: OpenClaw Skill Name: phylo-tree Version: 1.0.2 The skill bundle is a legitimate bioinformatics pipeline for phylogenetic tree construction. It orchestrates standard tools like MAFFT, IQ-TREE, and trimAl via Python's subprocess module and fetches data from the public UniProt API (rest.uniprot.org). While it includes capabilities for external reporting via Feishu (lark-cli), these are documented features for scientific collaboration. The scripts use safe subprocess practices (passing arguments as lists) and lack any evidence of intentional malicious behavior, credential theft, or unauthorized persistence.