The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill interacts with ota-internal.nvidia.com to fetch update metadata and download application installers. This domain belongs to a well-known technology provider (NVIDIA). The skill enforces strict security protocols for these downloads, requiring the agent to verify the file size, SHA-512 checksum, and the presence of a valid NVIDIA Corporation Authenticode signature before any execution.
[COMMAND_EXECUTION]: The skill uses PowerShell commands to perform system discovery (e.g., checking for existing installations, determining CPU architecture) and to launch the official installer. These actions are limited to the skill's primary purpose and are gated by explicit instructions to never use silent/unattended flags, ensuring that the final execution remains under the user's control via standard Windows UAC prompts.
[DATA_EXPOSURE_SAFE]: The skill reads specific, documented local configuration files (like gateway.json) to identify the network port used by the Broadcast service. It contains explicit prohibitions against accessing sensitive environment variables, credential stores, or shell profiles.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as media files, image paths, and JSON responses from the local gateway API. While this represents a potential attack surface, the risk is mitigated by the use of structured tool schemas (MCP), strict validation of file paths, and instructions to the agent to summarize outputs rather than echoing raw external content back to the user.

nvidia-broadcast