Atlas / Skills / alncat / opus-et-agent

opus-et-agentBLOCK

skills/alncat/opus-et-agent

OPUS-ET-AGENT: An agentic workflow for cryo-ET that turns raw movies into molecular sociology

Verdict
BLOCK
Grade
D
Trust score
61 /100
Version
—
Hosts
1 documented
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Claude Code — your resident cryo-ET conductor, at the bench.

A supervised-autonomy conductor (Claude Code) that drives the cryo-ET reconstruction pipeline end-to-end — WARP → AreTomo2 → PyTOM → OPUS-ET → M — pausing at each scientific gate for a human sign-off, self-correcting known failures, and mapping the refined molecules back inside the cell (ChimeraX/ArtiaX). Built on top of a set of great cryo-ET data-processing software — WARP/M, AreTomo2, PyTOM, OPUS-ET, ChimeraX, and ArtiaX.

The payoff — every ribosome (blue) and fatty-acid synthase (gold) placed back at its pose inside one real cell: molecular sociology, read straight off the data. ▶ watch it rotate

▶ Watch the demo walkthrough — Claude Code drives the full cryo-ET pipeline end-to-end, pausing at each human gate for sign-off.

The task — and why it matters

Cryo-electron tomography (cryo-ET) is the only technique that resolves macromolecules at near-molecular detail inside intact cells — structural biology in situ, where you see not just a molecule's shape but where it sits and who it sits with ("molecular soc

Read from source at commit b9fda9e8d874OBSERVED · 2026-10-14
Advertisement
02

Install

Commands as the repository documents them. They are shown, not run.

git clone https://github.com/alncat/opus-et-agent.git
git clone https://github.com/alncat/warp.git
git clone https://github.com/alncat/warp.git
03

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
04

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: opus-et-analysis
description: Use when the user has OPUS-ET training output and wants to interpret it: PCA or k-means over the latent codes of an epoch, volumes for cluster centres or principal components, per-state STAR files, pose parsing, the original pixel size, a training command for a new run, or a molecule mask and gold-standard FSC between half maps after Gate 3 or 4. Also use for state-vs-template and per-tomogram state-consistency checks.
---

# opus-et Analysis

Process and analyze cryo-ET training results from opus-et.

## Agent Rules — read before acting

- **Do only what the user asks.** Don't anticipate, extend, or fix unreported issues — even obvious ones. One change at a time.
- **Read before editing.** Always read the current file/script before describing or modifying it. Don't rely on remembered content — the codebase changes.
- **Verify before asserting.** If uncertain how a tool, flag, or script behaves, check (`--help`, API docs, actual output) rather than inferring from naming. Wrong documentation is worse than no documentation.
- **Enumerate scope before acting.** For multi-file changes, use `grep` to find all affected files and confirm scope with the user before making any edits.
- **Show before and after for every edit.** Before modifying a script or config, quote the relevant current lines. After editing, summarize exactly what changed — not just "done."
- **Don't chain changes.** Renaming a variable in one place does NOT mean you should rename it everywhere — confirm scope first.
- **Don't redesign.** Apparent inconsistencies may be intentional. Respect the existing pattern unless the user asks to change it.
- **When in doubt, show the current state and ask.** "Here's what I see. Do you want me to change X, Y, or both?"


## Training Command Generation
`scripts/generate_train_cmd.py --help` generates the training script -- the template it emits is reproduced verbatim in the reference, with every parameter explained; prefer the script to hand-editing. Full text: `references/training_command.md`.

## Helper Scripts

The following helper scripts ship with this skill and are located in the skill's `scripts/` directory (not the project directory):

```
<skill-dir>/scripts/
```

`<skill-dir>` is the directory where this skill is installed. When invoking the scripts from a project working directory, replace `<skill-dir>` with the actual skill path, or copy/symlink the scripts into your project. Examples below use `<skill-dir>` as a placeholder.

### `generate_train_cmd.py`
Generates training commands with automatic pose pkl generation.
```bash
python <skill-dir>/scripts/generate_train_cmd.py [options]
```

### `extract_config.py`
Extracts configuration parameters from config.pkl.
```bash
python <skill-dir>/scripts/extract_config.py config.pkl
```

### `exclude_stars.py`
Checks overlap between two star files based on 3D coordinates.
```bash
python <skill-dir>/scripts/exclude_stars.py <reference.star> <query.star>
```

**Pixel size:** Auto-detected from `config.pkl` in the current directory (`Apix * downfrac`). Falls back to 3.37 Å if no config.pkl is found.

**Distance threshold:** `136/angpix` voxels = **136 Å** (constant physical distance regardless of pixel size).

## Determining the Original Pixel Size

The original data pixel size (needed for `parse_pose_star`, `exclude_stars.py`, etc.) can be found two ways:

**From config.pkl** (recommended):
```python
import pickle
config = pickle.load(open('config.pkl', 'rb'))
original_Apix = config['model_args']['Apix'] * config['dataset_args']['downfrac']
```

**From the star file** (alternative):
Check `_rlnDetectorPixelSize` (column 9) in the star file header — this is the original pixel size of the raw data.

The two values should agree closely. The star file value is the authoritative original; the config.pkl derivation is the training pipeline's record of it.

Use `<skill-dir>/scripts/extract_config.py` to extract config values including `original_Apix`.

## Quick Reference

Key parameters from `config.pkl`:
- `Apix = config['model_args']['Apix']` (training-effective pixel size)
- `downfrac = config['dataset_args']['downfrac']` (downsampling fraction)
- `original_Apix = Apix * downfrac` (original data pixel size — use for `parse_pose_star` and other original-data operations)
- `D = config['lattice_args']['D'] - 1` (effective box size is lattice D minus 1)
- `particles = config['dataset_args']['particles']` (original star file)

**Important:** The `Apix` stored in `config.pkl` is the training-effective pixel size. For operations on the original star file (e.g., `dsd parse_pose_star`), multiply by `downfrac` to get the original data pixel size:
```python
import pickle
config = pickle.load(open('config.pkl', 'rb'))
apix = config['model_args']['Apix'] * config['dataset_args']['downfrac']
```

Use `<skill-dir>/scripts/extract_config.py` to extract these values.

## Multi-Body Training

To enable multi-body deformation modeling, add `--masks <path_to_mask_params.pkl>` to the training command. The `mask_params.pkl` file contains rigid body definitions:

| Key | Description |
|-----|-------------|
| `com_bodies` | Centers of mass for each rigid body (shape: `[num_bodies, 3]`) |
| `principal_axes` | Principal axes defining body orientations |
| `orient_bodies` | Body orientation matrices |
| `rotate_directions` | Allowed rotation directions for each body |
| `in_relatives` | Rotation reference body index - body *i* rotates relative to body `in_relatives[i]` |
| `radii_bodies` | Radii for each body |

### Parameter Clarification

- **`ZDIM`**: Composition latent space dimension - captures structural/compositional heterogeneity
- **`--zaffinedim`**: Conformation latent space dimension - captures continuous conformational changes (independent of deformation modeling)
- **`--masks`**: Enables rigid body deformation modeling using the body definitions in `mask_params.pkl`

These three mechanisms operate independently:
- **
05

Trust audit

BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
declared (3 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (24)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
opus-et-analysis/scripts/compare_to_template.py:166
labels = np.asarray(pickle.load(f)).ravel()
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
opus-et-analysis/scripts/extract_config.py:20
config = pickle.load(f)
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
opus-et-analysis/scripts/state_tomo_stats.py:109
cluster_of_particle = np.asarray(pickle.load(f)).ravel()
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
demo/stage_gate.py:109
print(f"warning: no checkpoint matched {gate!r} (token {token!r}).")
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
opus-et-status/SKILL.md:21
Then open <http://127.0.0.1:8080>.
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
opus-et-status/tests/test_config_edit.py:252
"../../../etc/passwd", "/etc/passwd", "species.conf; rm -rf /",
LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59
opus-et-status/tests/test_server.py:689
"../../etc/passwd", "/etc/passwd", "qc/../../secret.png", "qc/not_listed.png",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
opus-et-status/tests/test_config_edit.py:252
"../../../etc/passwd", "/etc/passwd", "species.conf; rm -rf /",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
opus-et-status/tests/test_config_edit.py:272
"../../etc/passwd", "a/b", "has space", "semi;colon", "$(id)", "", "-" * 40,
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
opus-et-status/tests/test_server.py:689
"../../etc/passwd", "/etc/passwd", "qc/../../secret.png", "qc/not_listed.png",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
opus-et-status/tests/test_server.py:740
"TS_999", "../../etc/passwd", "TS_026; rm -rf /", "$(id)", "",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
opus-et-status/tests/test_sources.py:138
out = sources.parse_qc_list("qc/ok.png\n../../etc/passwd\n/abs/path.png\nqc/../x.png\n")
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:154
Then open <http://127.0.0.1:8080>. `--host` is any SSH alias that already works without a password prompt; `--work-dir` is the run directory on the cluster. Where `python3` is not on `PATH` in a non-i
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
opus-et-status/tests/test_server.py:77
yield f"http://127.0.0.1:{port}", editor
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
opus-et-status/tests/test_server.py:92
yield f"http://127.0.0.1:{httpd.server_address[1]}"
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
opus-et-status/tests/test_server.py:127
base = f"http://127.0.0.1:{httpd.server_address[1]}"
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
opus-et-status/scripts/cluster.py:110
return base64.b64decode(res.stdout)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
opus-et-status/tests/test_thon.py:71
png = base64.b64decode(out['image'])
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements-dev.txt
pytest, starfile, pandas, numpy, mrcfile, scipy, matplotlib
Why it matters. 7 requirement(s) not pinned with ==
Fix. pin exact versions
INFOInventory / provenance · inv.oversize · CWE-1104
demo/qc/finale/fas_TS028_scan.gif
demo/qc/finale/fas_TS028_scan.gif
Why it matters. 3804007 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
demo/qc/finale/fas_TS028_scan.mp4
demo/qc/finale/fas_TS028_scan.mp4
Why it matters. 17252497 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
demo/qc/finale/fas_raw_context.png
demo/qc/finale/fas_raw_context.png
Why it matters. 1489474 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
demo/qc/finale/finale_insitu.gif
demo/qc/finale/finale_insitu.gif
Why it matters. 2966649 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
demo/qc/finale/finale_insitu.mp4
demo/qc/finale/finale_insitu.mp4
Why it matters. 12321491 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha b9fda9e8d874full audit observations/trust-audit/skill/alncat__opus-et-agent.json · Report an issue / request a re-scan
06

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-14b9fda9e8d874BLOCKD61first audit
07

Questions

What does the opus-et-agent skill do?

OPUS-ET-AGENT: An agentic workflow for cryo-ET that turns raw movies into molecular sociology

Is opus-et-agent safe to install?

No — not without reading the findings first. The audit graded it D (61/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What can opus-et-agent access on my machine?

The audit observed that it reaches the network and runs shell commands. Each of those is consistent with what it says it does. Secrets in the source: none found.

Which assistants does opus-et-agent work with?

Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (b9fda9e8d874), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement