imaging-data-commons

SAFE max severity MEDIUMSkillSpector Do not install 55 registry K-Dense-AI last scanned 1 scan

Verdict safe, but 1 finding (1 medium), mainly data exfiltration. Most recent scan 2026-10-21.

Findings1
Critical0
High0
Medium1
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 55
Score55 / 100
Issues27
CategoriesData Exfiltration Anti-Refusal MCP Least Privilege
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Queries and downloads public cancer imaging data from NCI Imaging Data Commons. Supports IDC collection discovery, DICOM access, radiology (CT, MR, PET) and pathology AI datasets, metadata SQL, visualization, licensing, and citations. Uses public metadata and download routes without authentication; optional BigQuery and Google Healthcare routes require Google credentials.

Package
15 files, 239 KB
SKILL.md
3948 words, 12+ sections
Code
Python (1)
License
This skill is provided under the MIT License. IDC data itself has individual licensing (mostly CC-BY, some CC-NC) that must be respected when using the data.
Compatibility
Requires network access for hosted APIs, index fetching, citations, and downloads. Local Python workflows target idc-index 0.12.5; BigQuery and Google Healthcare require Google credentials.

SKILL.md covers: Imaging Data Commons · Overview · Verify IDC data version (should be "v24") · IDC MCP Server · When to Use This Skill · Quick Navigation · IDC Data Model · Index Tables · Available Tables · Joining Tables · Clinical Data Access · Data Access Options

Findings

MEDIUM Outbound network request primitives that can transmit data externally Data Exfiltrationstatic

Pattern detected: urllib.request.urlopen(

scripts/check_version.py:50

with urllib.request.urlopen(url, timeout=5) as response:
Remediation: Ensure network operations are necessary and document allowed destinations

What is in the package

FileKindSize
SKILL.mddoc31 KB
references/bigquery_guide.mddoc35 KB
references/cli_guide.mddoc9.3 KB
references/clinical_data_guide.mddoc12 KB
references/cloud_storage_guide.mddoc14 KB
references/dicomweb_guide.mddoc16 KB
references/digital_pathology_guide.mddoc15 KB
references/index_tables_guide.mddoc12 KB
references/licensing_and_citation.mddoc10 KB
references/mcp_guide.mddoc9.4 KB
references/parquet_access_guide.mddoc9.8 KB
references/rest_api_guide.mddoc33 KB
references/sql_patterns.mddoc17 KB
references/use_cases.mddoc8.5 KB
scripts/check_version.pyscript5.5 KB

External hosts referenced

github.com api.imaging.datacommons.cancer.gov learn.canceridc.dev docs.cloud.google.com storage.googleapis.com idc-index.readthedocs.io proxy.imaging.datacommons.cancer.gov portal.imaging.datacommons.cancer.gov cloud.google.com dicom.nema.org code.claude.com doi.org www.siemens-healthineers.com api.github.com boto3.amazonaws.com datastudio.google.com dicomweb-client.readthedocs.io discourse.canceridc.dev docs.aws.amazon.com docs.gdc.cancer.gov gdc.cancer.gov healthcare.googleapis.com highdicom.readthedocs.io idc-open-metadata.s3.amazonaws.com modelcontextprotocol.io pydicom.github.io pypi.org qupath.github.io registry.opendata.aws viewer.imaging.datacommons.cancer.gov

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

IDC_DICOMWEB_URL

Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills