pathml
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches model weights and research datasets from well-known services including Hugging Face, Warwick University, and Zenodo. It also retrieves bibliographic metadata from ArXiv for citations. All network operations are documented as requiring explicit user opt-in and disclosure of the endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from slide manifests (CSV), spatial schemas (JSON), and whole-slide images. It implements robust sanitization via dedicated validation scripts (
scripts/slide_manifest.py,scripts/validate_spatial_schema.py) that verify file paths, enforce strict schemas, and reject URLs or symlinks to prevent path traversal or context leakage. - Ingestion points:
scripts/slide_manifest.py,scripts/validate_spatial_schema.py, andscripts/image_qc.py. - Boundary markers: Explicit warnings in
SKILL.mdregarding data de-identification and patient health information (PHI) boundaries. - Capability inventory: File system access, subprocess execution, and computational pathology library operations.
- Sanitization: Strict schema validation, path traversal checks (rejecting dot segments and symlinks), and file size limits implemented in the shared
scripts/_common.pyutility. - [DYNAMIC_EXECUTION]: Documents the use of PathML's dataset loaders which may perform unsafe deserialization of
.ptfiles (Pickle-based). The skill provides explicit warnings against loading untrusted artifacts and offers local JSON-based validation as a safer alternative. - [COMMAND_EXECUTION]: Instructs the agent to perform local package installation and native dependency management using standard package managers (uv, apt, brew) for local research environment setup.
Audit Metadata