What is imaging-data-commons?

A workflow for querying and downloading public cancer imaging data from the National Cancer Institute's Imaging Data Commons, a collection of cancer scans and related imaging records. It supports formats and modalities such as DICOM, CT, MR, PET, and pathology datasets.

Use it to search IDC collections, query imaging metadata, download datasets, access DICOM studies, visualize records, and assess whether data can be used for a project or AI training.

It helps locate suitable public imaging collections, inspect their metadata, view data, and check usage licences before downloading. Many access routes are available without authentication, while some optional services require cloud credentials.

imaging-data-commons — Skill for Claude Code and Codex by K-Dense-AI

About the project

Scientific Agent Skills is a collection of reusable procedures that give AI agents capabilities for scientific research across areas such as biology, chemistry, medicine, and drug discovery. It is used by researchers and by people building AI scientist workflows with compatible coding agents. The catalogue contains many of the project's skills and supporting instructions.

K-Dense-AI/scientific-agent-skills · 50,453 stars · on GitHub · arxiv.org

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add K-Dense-AI/scientific-agent-skills --skill imaging-data-commons

Clone the repo

git clone --depth 1 https://github.com/K-Dense-AI/scientific-agent-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/k-dense-ai/scientific-agent-skills/imaging-data-commons/github.svg)](https://agentmods.dev/skills/k-dense-ai/scientific-agent-skills/imaging-data-commons)

Your own site

<a href="https://agentmods.dev/skills/k-dense-ai/scientific-agent-skills/imaging-data-commons"><img src="https://agentmods.dev/badge/skills/k-dense-ai/scientific-agent-skills/imaging-data-commons/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/k-dense-ai/scientific-agent-skills/imaging-data-commons"><img src="https://agentmods.dev/badge/skills/k-dense-ai/scientific-agent-skills/imaging-data-commons.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 73 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 7,373 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

Socket pass 2 Oct 2026
Snyk pass 2 Oct 2026
NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 6 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Data Exfiltration · line 64
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 85
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 212
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 218
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Excessive Agency · line 195
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Fix: Set explicit rate limits, timeouts, and resource quotas for API calls, file operations, and compute. Implement circuit breakers for runaway loops.
medium Data Exfiltration · line 219
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00073	$0.07373
Opus 5.5	$0.00029	$0.02949
Sonnet 5.5	$0.00015	$0.01475
Haiku 4.5	$0.00007	$0.00737

Measured 14d ago against content hash 8dd250a80dc6, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

imaging-data-commons scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/check_version.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`curl`; do not install anything.** Installing costs ~77 MB of packaged index data plus

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

imaging-data-commons — 100% identical, 81 lines differ
imaging-data-commons — 100% identical, 81 lines differ

skills/imaging-data-commons/SKILL.md · 500 lines

How it starts

The opening of the file, as written. The whole thing — 500 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Imaging Data Commons

Overview

Query and download public cancer imaging data from the National Cancer Institute Imaging Data Commons (IDC). No authentication required for data access.

Expected network access: IDC metadata is reachable three ways — a bundled local DuckDB index (offline after installation; additional indices are fetched from GitHub and clinical tables from S3), or the hosted IDC service over MCP or REST (api.imaging.datacommons.cancer.gov, no authentication). File downloads use public GCS (storage.googleapis.com) and AWS S3 (s3.amazonaws.com) — no authentication required. DICOMweb access uses either the public IDC proxy (proxy.imaging.datacommons.cancer.gov, no auth) or the Google Cloud Healthcare API (healthcare.googleapis.com, requires GCP authentication). Optional BigQuery queries (bigquery.googleapis.com) also require GCP authentication. Citation resolution contacts DOI services. Public IDC routes require no credentials; optional Google clients use Application Default Credentials.

Reviewed 2026-09-30: idc-index 0.12.5, idc-index-data 24.2.2, IDC v24; hosted API 3.0.0b3. Recheck at use time.

Choose the access path first. There is no single default: the cheapest correct path depends on the session and the task.

Session already has the IDC MCP server? Route discovery and metadata there — see IDC MCP Server.
Otherwise, is idc-index installed and current? Run python scripts/check_version.py. If it passes, use idc-index for everything.
Not installed, and the task is read-only metadata — counts, attribute values, collection lookups, SQL under 10 000 rows, licenses, citations, viewer URLs? Use the REST API over curl; do not install anything. Installing costs ~77 MB of packaged index data plus pandas, pyarrow, and duckdb, which a metadata question does not need. See Data Access Options.
Not installed, and the task needs more than metadata — downloading files, pandas or plotting, pydicom/SimpleITK, pathology tiling, results past 10 000 rows, or a version-pinned script the user re-runs? Install idc-index: check_version.py exits non-zero and prints the exact install command for the running interpreter. Prefer a virtual environment, then restart Python.

Read the full file on GitHub · 500 lines

Files

What ships with it

14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

14d ago Changed · +3 lines · -2 tokens per session 8dd250a80dc6
15d ago Changed 0f6f7dd60963
1mo ago First seen · 497 lines · 75 tokens per session scan A 27ceb36b3ee1

Subscribe to this mod's changes

imaging-data-commons is a skill published in the GitHub repository K-Dense-AI/scientific-agent-skills (50,453 stars, last pushed today), licensed MIT. It adds 73 tokens to every session and 7,373 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Research Scientific ai-scientist bioinformatics chemoinformatics claude claude-skills claudecode

discovery-toolbox

A routed repertoire of 90 scientific thinking operators for biological research agents - visual reasoning, detectability and information budgets, search reframing, causal identification, competing explanations, observation and selection processes, pipeline artifact diagnosis, effort allocation, and confirmation…

dekan-aleksandr/biodiscovery-skills · 122 tokens

discovery-director

Operate as a research director making original discoveries from a given biological question and dataset. Use when the task is open-ended scientific research, exploring omics or experimental data for findings, hypothesis generation and testing, screening a large candidate space of genes, variants, features or…

dekan-aleksandr/biodiscovery-skills · 114 tokens

imaging-data-commons