nvidia-cosmos-video

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references model weights, code, and documentation from NVIDIA's official GitHub and Hugging Face repositories. As NVIDIA is a well-known technology provider and Hugging Face is a standard industry registry, these references are considered safe under established trust guidelines.- [DYNAMIC_EXECUTION]: The documentation discusses the trust_remote_code capability in Hugging Face Transformers and the risks associated with loading model checkpoints in the legacy Python pickle format (.pt). It correctly identifies these as security surfaces and explicitly instructs users to avoid them in production, recommending the use of safetensors and independent code reviews for custom logic.- [DATA_EXFILTRATION]: The provided Python client is designed to interact with a self-hosted NVIDIA Inference Microservice (NIM) specifically configured at the loopback address (127.0.0.1). Analysis of the network logic confirms it does not transmit session data, environment variables, or generated artifacts to unverified external domains.- [COMMAND_EXECUTION]: The Python script performs local file operations (state management and video writing). It follows security best practices by using exclusive file creation flags (os.O_EXCL) to prevent race conditions and atomic renames to ensure data integrity during output generation.- [SAFE]: Overall, the skill promotes a secure lifecycle for AI model deployment, including the use of deployment manifests, read-only mounts for model weights, and the use of guardrails (face blurring and safety filters) consistent with responsible AI practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 06:41 PM