cuda-auto-tune

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes system commands to profile and analyze GPU kernels.\n
  • The scripts/ncu_profile.sh script runs the ncu (Nsight Compute) profiler on a provided command or binary.\n
  • The scripts/ncu_analyse.py script invokes the ncu CLI using subprocess.run to convert binary reports into CSV format for parsing.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for processing external profiling data.\n
  • Ingestion points: The scripts/ncu_analyse.py script ingests untrusted data from NCU-generated CSV report files.\n
  • Boundary markers: The skill produces structured markdown reports and console output with clear formatting.\n
  • Capability inventory: Capabilities are limited to file reads, subprocess.run calls for the ncu CLI tool, and generating analysis text. No eval or exec on data content was found.\n
  • Sanitization: The script uses the standard csv.DictReader for structured data ingestion, ensuring that fields are handled as data rather than instructions.\n- [SAFE]: The skill performs standard development environment maintenance.\n
  • It includes instructions and script commands to clear JIT and compilation caches (e.g., ~/.triton/cache, __pycache__, and /tmp/cutlass_cute_cache/), which is a required step for obtaining reliable performance data after kernel modifications.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 01:42 AM