skills/stanfish06/skillquarium/bids/Gen Agent Trust Hub

bids

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/update_schema.py script is designed to download the BIDS schema and Extension Proposals (BEPs) list from official sources, including GitHub and ReadTheDocs. These downloads target well-known repositories within the neuroimaging community and are used to keep the skill's reference materials up to date.
  • [COMMAND_EXECUTION]: The skill provides setup instructions for standard neuroimaging utilities such as pybids, heudiconv, and the BIDS validator using established package managers like pip (via uv) and deno. These are typical developmental dependencies for the stated purpose of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes BIDS datasets, which include metadata in JSON and TSV formats. While this represents a surface for indirect prompt injection should a dataset contain malicious instructions, the skill uses standard parsing libraries and the risk is considered low and standard for file-management utilities.
  • Ingestion points: SKILL.md (via PyBIDS indexing of datasets), scripts/update_schema.py (via downloading schema and BEP metadata).
  • Boundary markers: Boundary markers for external data are not explicitly defined in the example snippets, which is standard for data loading libraries.
  • Capability inventory: The skill is capable of reading and writing local metadata files and performing network downloads for schema updates.
  • Sanitization: Structured data is parsed using standard Python libraries (json, urllib, argparse) and established domain-specific packages.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 11:28 AM