nv-generate-mr-brain
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_mr_brain.pyusessubprocess.runto invoke the upstreamscripts.diff_model_infermodule andgitfor metadata collection. The commands are executed withoutshell=True, and the arguments are constructed from fixed entry points and validated configuration paths, minimizing the risk of command injection. - [EXTERNAL_DOWNLOADS]: The skill requires external assets including the
NV-Generate-CTMRrepository from GitHub and model weights from HuggingFace. These downloads are documented as prerequisites and target official vendor-controlled organizations, meeting safe usage criteria for specialized medical AI research tools. - [PROMPT_INJECTION]: The skill processes user-supplied JSON files to override model parameters, creating a surface for indirect prompt injection. However, the wrapper script
scripts/run_mr_brain.pyimplements robust mitigations by validating all input keys against a strict whitelist (OVERRIDE_KEYS) and performing type and range checks on values (e.g., dimensions and inference steps) before they are used.
Audit Metadata