pathml
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Remote Inference API. The skill documentation references the DeepCell API (deepcell.org) for performing remote nucleus segmentation. This is a well-known research service for cellular imaging.
- [COMMAND_EXECUTION]: Unsafe Deserialization Practice. The skill includes examples using 'torch.load()' for loading model weights. Since this function utilizes the 'pickle' module for deserialization, it represents a potential security risk if a user is prompted to load a model from an untrusted source.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. Ingestion points: The skill is designed to ingest whole-slide images in over 160 formats and clinical metadata from CSV files (documented in 'references/image_loading.md' and 'references/data_management.md'). Boundary markers: The provided examples do not use explicit delimiters or instructions to ignore instructions embedded in metadata. Capability inventory: The skill has the capability to write to the local file system (HDF5, CSV), perform network operations via remote APIs, and execute distributed processing tasks using Dask. Sanitization: No specific sanitization or validation logic for the content of external image metadata or clinical records is described in the provided documentation.
Audit Metadata