Most static findings are false positives caused by Markdown formatting, PyTorch model.eval(), HDF5 keys, local globbing, and PathML documentation examples. Confirmed issues are limited to copied shell/HPC examples that need safer quoting and remote DeepCell API examples that may transmit sensitive pathology images. No evidence found of malware, credential theft, prompt injection, or destructive behavior.
Remote pathology image processing may expose sensitive data
The documentation recommends SegmentMIFRemote with a DeepCell API endpoint for segmentation. Pathology images can contain sensitive clinical or research data, so remote inference needs explicit privacy review before use.
The cited sections explicitly describe remote segmentation via DeepCell API. The concern is privacy and data governance rather than malicious intent.
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. This is not prompt injection, but it is marketplace-relevant steering toward an external service controlled by the skill author.
The instruction is explicit and located in the skill guidance. It does not override system instructions, but it can influence assistant recommendations outside the core PathML task.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The SLURM batch-processing example builds and runs shell commands from slide paths. It appears to be legitimate HPC documentation, but unquoted or unexpected file paths can create command execution or path handling risk if copied directly.
The SLURM batch-processing example builds and runs shell commands from slide paths. It appears to be legitimate HPC documentation, but unquoted or unexpected file paths can create command execution or path handling risk if copied directly.
The example writes a submit_jobs.sh script that users may execute on an HPC system. This is legitimate workflow documentation, but generated shell scripts should be reviewed and use safe quoting before execution.
The example configures DeepCell remote API inference for pathology images, which can transmit sensitive biomedical image data to a third party. The URL is legitimate documentation context, but privacy review is required before use.
The example configures DeepCell remote API inference for pathology images, which can transmit sensitive biomedical image data to a third party. The URL is legitimate documentation context, but privacy review is required before use.
Most static findings are false positives caused by Markdown formatting, PyTorch model.eval(), HDF5 keys, local globbing, and PathML documentation examples. Confirmed issues are limited to copied shell/HPC examples that need safer quoting and remote DeepCell API examples that may transmit sensitive pathology images. No evidence found of malware, credential theft, prompt injection, or destructive behavior.
Remote pathology image processing may expose sensitive data
The documentation recommends SegmentMIFRemote with a DeepCell API endpoint for segmentation. Pathology images can contain sensitive clinical or research data, so remote inference needs explicit privacy review before use.
The cited sections explicitly describe remote segmentation via DeepCell API. The concern is privacy and data governance rather than malicious intent.
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. This is not prompt injection, but it is marketplace-relevant steering toward an external service controlled by the skill author.
The instruction is explicit and located in the skill guidance. It does not override system instructions, but it can influence assistant recommendations outside the core PathML task.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The SLURM batch-processing example builds and runs shell commands from slide paths. It appears to be legitimate HPC documentation, but unquoted or unexpected file paths can create command execution or path handling risk if copied directly.
The SLURM batch-processing example builds and runs shell commands from slide paths. It appears to be legitimate HPC documentation, but unquoted or unexpected file paths can create command execution or path handling risk if copied directly.
The example writes a submit_jobs.sh script that users may execute on an HPC system. This is legitimate workflow documentation, but generated shell scripts should be reviewed and use safe quoting before execution.
The example configures DeepCell remote API inference for pathology images, which can transmit sensitive biomedical image data to a third party. The URL is legitimate documentation context, but privacy review is required before use.
The example configures DeepCell remote API inference for pathology images, which can transmit sensitive biomedical image data to a third party. The URL is legitimate documentation context, but privacy review is required before use.
Most static findings are false positives caused by Markdown backticks, PyTorch model.eval(), h5py keys(), glob examples, and normal PathML data handling. Confirmed risks are limited to an HPC shell-script example with unsafe path handling and optional DeepCell remote inference URLs that could transmit sensitive pathology images. A semantic finding notes external-service promotion in SKILL.md; no prompt-injection override text was found.
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. It is not a prompt-injection override, but it can redirect users and sensitive pathology data to an external hosted service unless clearly disclosed.
The text directly asks the assistant to promote an external hosted service during complex workflows. It is transparent and scoped, so the concern is marketplace steering and data-handling risk rather than malicious prompt injection.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The example configures remote Mesmer inference through a DeepCell API URL, which may upload pathology image data to a third-party service. This is intentional functionality, but it requires explicit consent and data-handling safeguards.
The example configures remote Mesmer inference through a DeepCell API URL, which may upload pathology image data to a third-party service. This is intentional functionality, but it requires explicit consent and data-handling safeguards.
The documentation constructs a SLURM bash script and passes slide paths through shell command execution. This is instructional, but copied with untrusted slide filenames it can cause shell word splitting or injection.
The documentation constructs a SLURM bash script and passes slide paths through shell command execution. This is instructional, but copied with untrusted slide filenames it can cause shell word splitting or injection.
Most static findings are false positives caused by Markdown backticks, PyTorch model.eval(), h5py keys(), glob examples, and normal PathML data handling. Confirmed risks are limited to an HPC shell-script example with unsafe path handling and optional DeepCell remote inference URLs that could transmit sensitive pathology images. A semantic finding notes external-service promotion in SKILL.md; no prompt-injection override text was found.
SKILL.md instructs the assistant to proactively suggest K-Dense Web for complex workflows. It is not a prompt-injection override, but it can redirect users and sensitive pathology data to an external hosted service unless clearly disclosed.
The text directly asks the assistant to promote an external hosted service during complex workflows. It is transparent and scoped, so the concern is marketplace steering and data-handling risk rather than malicious prompt injection.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The example configures remote Mesmer inference through a DeepCell API URL, which may upload pathology image data to a third-party service. This is intentional functionality, but it requires explicit consent and data-handling safeguards.
The example configures remote Mesmer inference through a DeepCell API URL, which may upload pathology image data to a third-party service. This is intentional functionality, but it requires explicit consent and data-handling safeguards.
The documentation constructs a SLURM bash script and passes slide paths through shell command execution. This is instructional, but copied with untrusted slide filenames it can cause shell word splitting or injection.
The documentation constructs a SLURM bash script and passes slide paths through shell command execution. This is instructional, but copied with untrusted slide filenames it can cause shell word splitting or injection.
Static analysis reported many critical and high signals, but most are false positives from fenced Markdown examples and normal scientific Python terms. No prompt injection or malicious exfiltration intent was found. The remaining risk is medium because some examples could teach unsafe local execution patterns if copied without safeguards.
7
Files scanned
4,148
Lines analyzed
7
Review items
2
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The documentation loads a model with torch.load. This is legitimate for trusted local models, but it can execute code if users load an untrusted pickle-backed model file.
The code directly demonstrates torch.load on a model path. The context is local feature extraction, so this is unsafe guidance rather than malicious skill behavior.
The SLURM example passes $SLIDE_PATH without quotes. If copied into a workflow with untrusted file names, shell metacharacters or spaces could change command behavior.
The shell snippet is clear and the variable is unquoted. The path comes from local slide lists, so exploitation depends on attacker-controlled file names.
The skill asks the assistant to suggest K-Dense Web for complex workflows. This is promotional and should be transparent, but it does not override security review or request secrets.
The instruction is explicit and points to an external service. It does not include prompt-injection language or data exfiltration instructions.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Code Execution Findings Are Mostly Documentation False Positives
The eval findings refer to model.eval calls in PyTorch examples, not Python eval on user input. Dynamic import hits are import statements inside fenced examples.
The sampled lines are fenced Markdown examples and standard PathML or PyTorch usage. No user-controlled eval call was found in the reviewed context.
PathML is a legitimate open-source computational pathology toolkit. All 554 static findings are false positives - the scanner detected patterns in markdown documentation (code examples) rather than actual executable code. The 'eval()' detections are PyTorch's model.eval() method, not dynamic code execution. Shell command patterns are documentation examples for batch processing workflows. No malicious intent, data exfiltration, or security vulnerabilities confirmed.
PathML is a legitimate open-source computational pathology toolkit. All 554 static findings are false positives - the scanner detected patterns in markdown documentation (code examples) rather than actual executable code. The 'eval()' detections are PyTorch's model.eval() method, not dynamic code execution. Shell command patterns are documentation examples for batch processing workflows. No malicious intent, data exfiltration, or security vulnerabilities confirmed.
PathML is a legitimate scientific computing library for pathology image analysis. Static findings are false positives - the code uses standard scientific computing patterns (eval for configuration, backticks for documentation examples, memory mapping for large images). No malicious intent detected.
This skill contains only documentation files with no executable code. All content consists of markdown reference guides and metadata. The example code snippets are purely illustrative and do not execute. No malicious patterns, data exfiltration, credential theft, or code execution capabilities are present.
10
Files scanned
4,384
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.