imaging-data-commons
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes instructions to execute
pip3 installvia the Pythonsubprocessmodule. This is used to ensure theidc-indexpackage is updated to the required version for compatibility with the IDC data release (v23). - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of medical imaging data (DICOM) and metadata indices (Parquet files) from public Amazon S3 and Google Cloud Storage buckets managed by the Imaging Data Commons. These are well-known scientific repositories.
- [PROMPT_INJECTION]: The skill processes untrusted metadata such as
SeriesDescriptionandAnnotationGroupLabelretrieved from the IDC database. This data represents an indirect prompt injection surface; however, the risk is minimal given the specialized medical context and the intended research application.
Audit Metadata