nemotron-add-step
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local validation logic and test suites via
uv run(e.g.,uv run python src/nemotron/steps/index.pyanduv run pytest tests/steps -q). These commands are restricted to the local repository environment and are necessary for the skill's primary purpose of verifying newly generated workflow steps. - [PROMPT_INJECTION]: The skill accepts user-provided descriptions, category labels, and artifact types to populate generated files. While this creates an attack surface for indirect prompt injection into the codebase, the skill mitigates risk by enforcing a 30-line limit on generated scripts and requiring successful execution of local validation schemas and unit tests before finalizing the changes.
Audit Metadata