nv-generate-mr-brain-finetune
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches model code and weights from official GitHub and Hugging Face repositories. The sources are well-known services and the repositories belong to the authoring organization.
- [COMMAND_EXECUTION]: Orchestrates the training workflow using shell commands. The wrapper script implements strong security controls, including verifying the Git commit of external code and ensuring a clean repository state before execution. It also implements environment variable filtering to ensure that parent process secrets (e.g., API keys, tokens) are not leaked to subprocesses.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied NIfTI images and JSON datalists.
- Ingestion points: Data enters via the
datalistJSON file and thedata_base_dir. - Boundary markers: The script performs strict validation of the JSON schema and enforces relative path constraints.
- Capability inventory: Execution is restricted to a set of predefined ML training scripts.
- Sanitization: Inputs are validated against a supported list of modalities and existing file paths.
Audit Metadata