pacsomatic
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/run_pacsomatic.pyscript executes various system utilities includingjava,git,nextflow, and HPC scheduler commands (sbatch,bsub,qsub) using thesubprocessmodule. The implementation uses list-based arguments to prevent shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The script is designed to clone the
nf-core/pacsomaticpipeline repository from GitHub. This targets a well-known bioinformatics organization and the operation is triggered by explicit user configuration flags. - [DYNAMIC_EXECUTION]: The helper generates a bash launch script at runtime based on user-provided parameters and subsequently executes it. The script utilizes
shlex.quoteand a custom metacharacter filter (_SHELL_METACHARACTERS) to sanitize inputs before they are written into the executable shell script. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data, such as sample identifiers and file paths, which are incorporated into command-line arguments and generated scripts.
- Ingestion points: Command-line arguments processed in
scripts/run_pacsomatic.py(e.g.,--tumor-bam,--patient-id). - Boundary markers: The script enforces strict validation rules, ensuring identifiers contain no whitespace or control characters.
- Capability inventory: The script possesses capabilities to write files to the local filesystem and execute subprocesses (
git,nextflow, scheduler binaries). - Sanitization: Inputs are sanitized using
shlex.quoteduring script generation and list-basedsubprocess.runcalls for direct execution.
Audit Metadata