imaging-data-commons
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python code in
SKILL.mdthat usessubprocess.runto executepip3 install --upgrade idc-index. This is intended to ensure the agent's environment has the specific version of the required library needed to access the current data release. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of medical imaging datasets from official public cloud storage buckets on AWS S3 (
s3://idc-open-data) and Google Cloud Storage (gs://idc-open-data). These are standard repositories for the Imaging Data Commons project. - [EXTERNAL_DOWNLOADS]: The skill fetches metadata tables in Parquet format from an official Google Cloud Storage artifact bucket (
storage.googleapis.com/idc-index-data-artifacts). - [EXTERNAL_DOWNLOADS]: The skill references and opens URLs for the official IDC Portal and medical image viewers hosted at
*.imaging.datacommons.cancer.gov. - [PROMPT_INJECTION]: The skill ingests and processes clinical metadata and imaging identifiers (such as study descriptions and patient IDs) from external SQL queries. This represents an indirect prompt injection surface, though the source data is a public research repository.
Audit Metadata