cvat-push
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the CVAT_ACCESS_TOKEN environment variable for authentication, which is a secure and standard practice for managing sensitive credentials.
- [COMMAND_EXECUTION]: Executes the yolo-cvat CLI tool to push images and labels to a configured CVAT server. This command is restricted to the skill's primary purpose and uses local data sources.
- [PROMPT_INJECTION]: The skill processes project-specific files like reports/uncertain_images.txt and yolo-project.yaml. This presents an indirect prompt injection surface.
- Ingestion points: reports/uncertain_images.txt and yolo-project.yaml in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: Execution of yolo-cvat and file writing to experiments/cvat_push_report.md.
- Sanitization: Absent; the skill assumes these files are generated by trusted local training analysis steps.
Audit Metadata