cellprofiler
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/nuclei_assay.pyfacilitates the execution of the CellProfiler binary through thesubprocess.runfunction. The executable path is configurable via the--executableCLI argument. The command is constructed as a list of strings and executed without a shell, which mitigates standard shell injection vulnerabilities while allowing the user to specify the analysis runtime. - [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs including a CSV manifest and TIFF image files, creating a potential surface for indirect injection.
- Ingestion points: Input data is sourced from a user-provided
images.csvmanifest and the output files generated by the CellProfiler process (Image.csv,Nuclei.csv). - Boundary markers: The processing logic does not employ explicit natural language boundary markers or instructions to ignore embedded directives in the data.
- Capability inventory: The skill possesses the ability to read from the local filesystem, write result files and logs, and invoke external processes.
- Sanitization: The script implements validation measures, such as verifying
sample_idstrings against a restrictive alphanumeric regex ([A-Za-z0-9][A-Za-z0-9_.-]*) and enforcing that image files are single-plane grayscale TIFFs with validuint8oruint16bit depths.
Audit Metadata