bids
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/update_schema.pyscript is designed to download the BIDS schema and Extension Proposals (BEPs) list from official sources, including GitHub and ReadTheDocs. These downloads target well-known repositories within the neuroimaging community and are used to keep the skill's reference materials up to date. - [COMMAND_EXECUTION]: The skill provides setup instructions for standard neuroimaging utilities such as
pybids,heudiconv, and the BIDS validator using established package managers likepip(viauv) anddeno. These are typical developmental dependencies for the stated purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes BIDS datasets, which include metadata in JSON and TSV formats. While this represents a surface for indirect prompt injection should a dataset contain malicious instructions, the skill uses standard parsing libraries and the risk is considered low and standard for file-management utilities.
- Ingestion points:
SKILL.md(via PyBIDS indexing of datasets),scripts/update_schema.py(via downloading schema and BEP metadata). - Boundary markers: Boundary markers for external data are not explicitly defined in the example snippets, which is standard for data loading libraries.
- Capability inventory: The skill is capable of reading and writing local metadata files and performing network downloads for schema updates.
- Sanitization: Structured data is parsed using standard Python libraries (
json,urllib,argparse) and established domain-specific packages.
Audit Metadata