complexa-sweep
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute complex shell loops and sharding logic (e.g.,
CUDA_VISIBLE_DEVICES) to orchestrate thecomplexadesign pipeline across multiple GPUs. These operations are essential to the skill's hyperparameter tuning functionality and include a user confirmation gate to manage GPU time and costs.\n- [DYNAMIC_EXECUTION]: The skill performs dynamic configuration generation by usingscript_utils/generate_inference_configs.pyto create YAML files based on user-defined sweep axes. These files are subsequently used to drive the design process.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its result aggregation logic.\n - Ingestion points: The skill reads evaluation metrics from CSV files in the
./evaluation_results/directory.\n - Boundary markers: The skill uses standard CSV parsing without specific delimiters to isolate external data from instructions.\n
- Capability inventory: The skill can execute shell commands, write files, and query the user.\n
- Sanitization: There is no evidence of sanitization of the CSV data before it is incorporated into the ranking summary and manifest.\n- [EXTERNAL_DOWNLOADS]: The skill references source code, licenses, and documentation on NVIDIA's official GitHub organization. These references to a well-known and trusted vendor are appropriate for the skill's context and do not represent a security risk.
Audit Metadata