cellprofiler

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/nuclei_assay.py facilitates the execution of the CellProfiler binary through the subprocess.run function. The executable path is configurable via the --executable CLI argument. The command is constructed as a list of strings and executed without a shell, which mitigates standard shell injection vulnerabilities while allowing the user to specify the analysis runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs including a CSV manifest and TIFF image files, creating a potential surface for indirect injection.
  • Ingestion points: Input data is sourced from a user-provided images.csv manifest and the output files generated by the CellProfiler process (Image.csv, Nuclei.csv).
  • Boundary markers: The processing logic does not employ explicit natural language boundary markers or instructions to ignore embedded directives in the data.
  • Capability inventory: The skill possesses the ability to read from the local filesystem, write result files and logs, and invoke external processes.
  • Sanitization: The script implements validation measures, such as verifying sample_id strings against a restrictive alphanumeric regex ([A-Za-z0-9][A-Za-z0-9_.-]*) and enforcing that image files are single-plane grayscale TIFFs with valid uint8 or uint16 bit depths.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 11:09 PM