datalad
No security findings. Scanned 1 time, most recently 2026-10-21.
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Retrieves, versions, and publishes scientific datasets with DataLad and git-annex, and captures computational provenance with datalad run, rerun, and containers-run. Use when cloning or fetching data from OpenNeuro, DANDI, datasets.datalad.org, or any DataLad dataset; when a file in a dataset reads as a broken symlink or a small pointer instead of real data; when an analysis needs a machine-readable record of how each output was produced so it can be re-executed; or when publishing a dataset to siblings such as a GitHub repository plus a storage remote. Also use to decide between DataLad and…
- Package
- 4 files, 51 KB
- SKILL.md
- 2270 words, 12+ sections
- Code
- None. Instructions only.
- Allowed tools
ReadWriteEditBash- License
- MIT
- Compatibility
- Requires Python 3.10+, DataLad 1.6.5, Git, and git-annex 10.x. Tested with git-annex 10.20260901 and datalad-container 1.2.6 on macOS ARM64. Containers additionally require Singularity, Apptainer, or Docker. Remote data access needs network access and may need provider credentials. Local filesystem workflows work offline.
SKILL.md covers: DataLad · Overview · When to use DataLad instead of plain Git · Installation · git-annex is NOT written in Python but is available from PyPI if you already · have git itself installed: · You can also install it first from the system · (Debian/Ubuntu: apt install git-annex; macOS: brew install git-annex; · conda-forge: conda install -c conda-forge git-annex) · The failure that bites first: pointers are not data · Recording provenance with datalad run · Re-executing
Findings
No findings. SAFE
What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 17 KB |
references/data-access.md | doc | 9.5 KB |
references/provenance.md | doc | 14 KB |
references/publishing.md | doc | 11 KB |
External hosts referenced
github.com docs.datalad.org handbook.datalad.org stamped-principles.org blog.datalad.org checklist.stamped-principles.org examples.stamped-principles.org git-annex.branchable.com registry.datalad.org bids.neuroimaging.io datasets.datalad.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Bytecode analyzer.
- Pipeline analyzer.
- Correlation analyzer.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/K-Dense-AI/scientific-agent-skills
- Raw scan result: skills-datalad-scan.json
- Badge for your README:
- Request a re-scan