nv-segment-ct-finetune
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads pretrained model weights and configuration files from HuggingFace (nvidia/NV-Segment-CT) and GitHub (NVIDIA-Medtech/NV-Segment-CTMR). These sources are controlled by a trusted organization and are necessary for the skill's primary function.
- [COMMAND_EXECUTION]: The execution script uses the subprocess module to manage the training environment, including creating virtual environments, installing specific package versions (monai==1.4.0), and launching the training bundle via torchrun. Commands are properly structured as lists to mitigate command injection risks.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted dataset directories and JSON datalists provided by the user.
- Ingestion points: The
dataset_diranddatalistparameters are read and processed inscripts/run_finetune.py. - Boundary markers: Not applicable, as the skill operates on binary NIfTI images and structured JSON rather than natural language prompts.
- Capability inventory: The skill can write to the local filesystem and execute training sub-processes.
- Sanitization: The script performs extensive dataset auditing, verifying file existence, NIfTI header consistency, and label mappings before execution.
Audit Metadata