nv-segment-ct-finetune
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_finetune.pymanages the training environment by spawning subprocesses to install required Python packages (monai,numpy) and to launch the MONAI training bundle usingsubprocess.callandos.execvpe. These operations are well-scoped to the skill's purpose and include protection against command injection via the use ofshlex.quoteduring command construction. - [EXTERNAL_DOWNLOADS]: The skill fetches model assets and configuration data from official NVIDIA-maintained sources, including the
nvidia/NV-Segment-CTrepository on Hugging Face and theNVIDIA-Medtech/NV-Segment-CTMRrepository on GitHub. These actions use standard libraries likehuggingface_hubandurllib.requestand target well-known, trusted domains. - [SAFE]: The 'PII/gps_coordinates' finding mentioned in the skill's own
BENCHMARK.mdwas analyzed and determined to be a false positive. The script accesses NIfTI file headers solely to extract spatial orientation and voxel spacing (affine matrices), which are essential for medical image processing and do not involve the collection of personal identification or location data. - [SAFE]: The skill implements a comprehensive data audit phase in
scripts/run_finetune.pythat verifies NIfTI file integrity, coordinate alignment, and Hounsfield Unit (HU) ranges before processing, which acts as a safeguard against malformed data inputs.
Audit Metadata