bids

SAFE max severity MEDIUMSkillSpector Caution 34 registry K-Dense-AI last scanned 1 scan

Verdict safe, but 2 findings (2 medium), mainly data exfiltration. Most recent scan 2026-10-21.

Findings2
Critical0
High0
Medium2
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 34
Score34 / 100
Issues3
CategoriesYARA Match MCP Least Privilege MCP Rug Pull
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Organizes, queries, validates, and converts Brain Imaging Data Structure (BIDS) datasets. Supports organizing neuroscience and biomedical data (MRI, EEG, MEG, iEEG, PET, microscopy, NIRS, motion capture, EMG, MR spectroscopy, behavioral), querying BIDS layouts, validating compliance, converting DICOM to BIDS, writing metadata sidecars, or creating BIDS derivatives.

Package
8 files, 910 KB
SKILL.md
1829 words, 12+ sections
Code
Python (1)
License
https://creativecommons.org/licenses/by/4.0/
Compatibility
Requires Python 3.10+ for PyBIDS and the validator wrapper; dcm2niix for DICOM conversion. Network access for installation and schema updates; no API credentials required.

SKILL.md covers: Brain Imaging Data Structure (BIDS) · Overview · When to Use This Skill · Installation · Core BIDS querying library · BIDS validator (Deno-based, installed via PyPI wrapper) · Alternative: install directly via Deno · deno install -ERWN -g -n bids-validator jsr:@bids/validator · DICOM-to-BIDS converters (install as needed) · BIDScoin: uv pip install bidscoin · Useful companions · Core Workflows

Findings

MEDIUM Outbound network request primitives that can transmit data externally Data Exfiltrationstatic

Pattern detected: urllib.request.Request(

scripts/update_schema.py:35

req = urllib.request.Request(url, headers={"User-Agent": "bids-skill-updater/1.1"})
Remediation: Ensure network operations are necessary and document allowed destinations
MEDIUM Outbound network request primitives that can transmit data externally Data Exfiltrationstatic

Pattern detected: urllib.request.urlopen(

scripts/update_schema.py:36

with urllib.request.urlopen(req, timeout=TIMEOUT_SECONDS) as resp:
Remediation: Ensure network operations are necessary and document allowed destinations

What is in the package

FileKindSize
SKILL.mddoc14 KB
references/beps.ymlconfig25 KB
references/bids_schema.jsonconfig806 KB
references/bids_specification.mddoc9.0 KB
references/conversion_tools.mddoc20 KB
references/core_workflows.mddoc20 KB
references/metadata_fields.mddoc11 KB
scripts/update_schema.pyscript4.0 KB

External hosts referenced

www.dicomlookup.com github.com docs.google.com doi.org bids-specification.readthedocs.io rrid.site www.nitrc.org www.ncbi.nlm.nih.gov sccn.ucsd.edu bidscoin.readthedocs.io docutils.sourceforge.io heudiconv.readthedocs.io www.brainproducts.com www.markdownguide.org bids-standard.github.io bids.neuroimaging.io dicom.nema.org eeglab.org raw.githubusercontent.com unfmontreal.github.io www.edfplus.info www.protocols.io atlas.brain-map.org bids-specification--1680.org.readthedocs.build bids-specification--1902.org.readthedocs.build bids-specification--2022.org.readthedocs.build bids-specification--2123.org.readthedocs.build bids-specification--2231.org.readthedocs.build bids-specification--2258.org.readthedocs.build bids-specification--2267.org.readthedocs.build

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills