nomogram-construction

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements strict validation for input clinical data in scripts/functions.R. It verifies that survival time columns contain positive numeric values and that event indicators are strictly binary (0 or 1). It also enforces minimum sample and event counts to ensure statistical validity and prevent processing of insufficient data.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes external R dependencies including rms, openxlsx, and qs. These are fetched from the official Comprehensive R Archive Network (CRAN) at https://cloud.r-project.org. As CRAN is a well-known and trusted service for R package distribution, these references are considered safe.
  • [COMMAND_EXECUTION]: The testing framework in tests/run_smoke_test.R uses system2 to run Rscript. These executions are limited to invoking the skill's own internal scripts for automated validation purposes and do not involve untrusted input, representing a safe use of command execution for development workflows.
  • [DYNAMIC_EXECUTION]: The build_nomogram_bundle function in scripts/functions.R dynamically constructs R model formulas using string concatenation of user-provided feature names. The resulting strings are processed by stats::as.formula, which is the standard and safe mechanism for defining models in R, staying entirely within the statistical environment without exposing the underlying system.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external clinical CSV files for analysis. It includes appropriate sanitization by explicitly converting columns to numeric or factor types and filtering for complete cases. The skill is scoped exclusively to statistical modeling and does not interpret input data as instructions for the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:43 PM