omero-integration
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides several standalone Python scripts (e.g.,
inventory.py,export_image_metadata.py,plan_transfer.py) designed to be executed by the agent to automate microscopy workflows and validate configurations. - These scripts are localized to the skill's specific research purpose and include strict
argparsevalidation to prevent arbitrary argument injection. - File operations within the scripts use atomic write patterns and enforce owner-only filesystem permissions for generated outputs.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata (such as image annotations, ROI labels, and tags) from remote OMERO servers, which is a potential injection surface.
- Ingestion points: Metadata is retrieved through the
omero-pygateway using methods likelistAnnotations()andcopyShapes()(referenced inreferences/metadata.mdandreferences/rois.md). - Boundary markers: The instructions throughout the skill and its references emphasize the use of hard caps on result counts and string lengths to limit the impact of large or malicious payloads.
- Capability inventory: The skill possesses the capability to perform network requests to OMERO servers, write JSON files to the local disk, and perform directory scans.
- Sanitization: The skill includes a dedicated utility,
omero_common.py, which provides ajson_safefunction used by all scripts to truncate long strings and limit the size of collections before they are processed by the agent. - [EXTERNAL_DOWNLOADS]: The skill guides the user to install
omero-pyand platform-specificzeroc_icewheels necessary for Ice middleware communication. - These resources are sourced from the official OpenMicroscopy Environment (OME) organization and their documented commercial partner, Glencoe Software, which are established and trusted entities in the scientific community.
Audit Metadata