cuda-auto-tune
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands to profile and analyze GPU kernels.\n
- The
scripts/ncu_profile.shscript runs thencu(Nsight Compute) profiler on a provided command or binary.\n - The
scripts/ncu_analyse.pyscript invokes thencuCLI usingsubprocess.runto convert binary reports into CSV format for parsing.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for processing external profiling data.\n - Ingestion points: The
scripts/ncu_analyse.pyscript ingests untrusted data from NCU-generated CSV report files.\n - Boundary markers: The skill produces structured markdown reports and console output with clear formatting.\n
- Capability inventory: Capabilities are limited to file reads,
subprocess.runcalls for thencuCLI tool, and generating analysis text. Noevalorexecon data content was found.\n - Sanitization: The script uses the standard
csv.DictReaderfor structured data ingestion, ensuring that fields are handled as data rather than instructions.\n- [SAFE]: The skill performs standard development environment maintenance.\n - It includes instructions and script commands to clear JIT and compilation caches (e.g.,
~/.triton/cache,__pycache__, and/tmp/cutlass_cute_cache/), which is a required step for obtaining reliable performance data after kernel modifications.
Audit Metadata