cvat-push

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill uses the CVAT_ACCESS_TOKEN environment variable for authentication, which is a secure and standard practice for managing sensitive credentials.
  • [COMMAND_EXECUTION]: Executes the yolo-cvat CLI tool to push images and labels to a configured CVAT server. This command is restricted to the skill's primary purpose and uses local data sources.
  • [PROMPT_INJECTION]: The skill processes project-specific files like reports/uncertain_images.txt and yolo-project.yaml. This presents an indirect prompt injection surface.
  • Ingestion points: reports/uncertain_images.txt and yolo-project.yaml in SKILL.md.
  • Boundary markers: Absent.
  • Capability inventory: Execution of yolo-cvat and file writing to experiments/cvat_push_report.md.
  • Sanitization: Absent; the skill assumes these files are generated by trusted local training analysis steps.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 02:55 PM
Security Audit — agent-trust-hub — cvat-push