skills/lifangda/claude-plugins/pathml/Gen Agent Trust Hub

pathml

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Remote Inference API. The skill documentation references the DeepCell API (deepcell.org) for performing remote nucleus segmentation. This is a well-known research service for cellular imaging.
  • [COMMAND_EXECUTION]: Unsafe Deserialization Practice. The skill includes examples using 'torch.load()' for loading model weights. Since this function utilizes the 'pickle' module for deserialization, it represents a potential security risk if a user is prompted to load a model from an untrusted source.
  • [PROMPT_INJECTION]: Indirect Prompt Injection Surface. Ingestion points: The skill is designed to ingest whole-slide images in over 160 formats and clinical metadata from CSV files (documented in 'references/image_loading.md' and 'references/data_management.md'). Boundary markers: The provided examples do not use explicit delimiters or instructions to ignore instructions embedded in metadata. Capability inventory: The skill has the capability to write to the local file system (HDF5, CSV), perform network operations via remote APIs, and execute distributed processing tasks using Dask. Sanitization: No specific sanitization or validation logic for the content of external image metadata or clinical records is described in the provided documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 04:01 AM
Security Audit — agent-trust-hub — pathml