nomogram-construction
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strict validation for input clinical data in
scripts/functions.R. It verifies that survival time columns contain positive numeric values and that event indicators are strictly binary (0 or 1). It also enforces minimum sample and event counts to ensure statistical validity and prevent processing of insufficient data. - [EXTERNAL_DOWNLOADS]: The skill utilizes external R dependencies including
rms,openxlsx, andqs. These are fetched from the official Comprehensive R Archive Network (CRAN) athttps://cloud.r-project.org. As CRAN is a well-known and trusted service for R package distribution, these references are considered safe. - [COMMAND_EXECUTION]: The testing framework in
tests/run_smoke_test.Rusessystem2to runRscript. These executions are limited to invoking the skill's own internal scripts for automated validation purposes and do not involve untrusted input, representing a safe use of command execution for development workflows. - [DYNAMIC_EXECUTION]: The
build_nomogram_bundlefunction inscripts/functions.Rdynamically constructs R model formulas using string concatenation of user-provided feature names. The resulting strings are processed bystats::as.formula, which is the standard and safe mechanism for defining models in R, staying entirely within the statistical environment without exposing the underlying system. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external clinical CSV files for analysis. It includes appropriate sanitization by explicitly converting columns to numeric or factor types and filtering for complete cases. The skill is scoped exclusively to statistical modeling and does not interpret input data as instructions for the agent.
Audit Metadata