imaging-data-commons
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches imaging metadata and DICOM files from official IDC infrastructure (
api.imaging.datacommons.cancer.gov) and established cloud services including Google Cloud Storage (storage.googleapis.com) and Amazon S3 (s3.amazonaws.com). These operations are essential for the skill's primary function of providing access to public cancer research data. - [COMMAND_EXECUTION]: Instructs the agent on using the
idc-indexPython library and theidcCLI tool to manage large-scale data transfers. A helper scriptscripts/check_version.pyis included to verify the local environment and suggest appropriate installation commands to maintain compatibility. - [INDIRECT_PROMPT_INJECTION]: The skill ingests clinical metadata and imaging attributes from external repositories, which represents a potential surface for indirect injection. The risk is mitigated by the highly structured nature of DICOM and clinical data, as well as the skill's emphasis on schema discovery and explicit query filtering.
- [SAFE]: The skill handles data access securely by using unauthenticated public endpoints for open data and instructing users to follow standard Google Cloud authentication protocols for private or billable services like BigQuery. No credentials or sensitive environment variables are hardcoded or accessed by the skill scripts.
Audit Metadata