nv-segment-ct-finetune

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/run_finetune.py manages the training environment by spawning subprocesses to install required Python packages (monai, numpy) and to launch the MONAI training bundle using subprocess.call and os.execvpe. These operations are well-scoped to the skill's purpose and include protection against command injection via the use of shlex.quote during command construction.
  • [EXTERNAL_DOWNLOADS]: The skill fetches model assets and configuration data from official NVIDIA-maintained sources, including the nvidia/NV-Segment-CT repository on Hugging Face and the NVIDIA-Medtech/NV-Segment-CTMR repository on GitHub. These actions use standard libraries like huggingface_hub and urllib.request and target well-known, trusted domains.
  • [SAFE]: The 'PII/gps_coordinates' finding mentioned in the skill's own BENCHMARK.md was analyzed and determined to be a false positive. The script accesses NIfTI file headers solely to extract spatial orientation and voxel spacing (affine matrices), which are essential for medical image processing and do not involve the collection of personal identification or location data.
  • [SAFE]: The skill implements a comprehensive data audit phase in scripts/run_finetune.py that verifies NIfTI file integrity, coordinate alignment, and Hounsfield Unit (HU) ranges before processing, which acts as a safeguard against malformed data inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 07:15 PM
Security Audit — agent-trust-hub — nv-segment-ct-finetune