skills/nvidia-nemo/speech/verify/Gen Agent Trust Hub

verify

Pass

Audited by Gen Agent Trust Hub on Jul 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes git diff to list files modified in the current session to determine the scope of verification.- [COMMAND_EXECUTION]: Runs style checks using python setup.py style, which involves executing a local build script to ensure code formatting compliance.- [COMMAND_EXECUTION]: Executes pytest across several core project directories (such as asr, tts, audio, speechlm2, and common) to verify the integrity of code changes.- [EXTERNAL_DOWNLOADS]: Several pytest commands include the --download flag, which triggers the retrieval of external datasets or pre-trained models required for verification. This is standard and expected behavior for the NeMo machine learning framework.- [PROMPT_INJECTION]: The skill ingests untrusted data in the form of file paths returned by the git command. Ingestion point: SKILL.md shell block. Boundary markers: None. Capability inventory: Shell execution of Python scripts and the pytest framework. Sanitization: None. This configuration creates a surface for indirect prompt injection, which is a common characteristic of repository management and development skills.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 22, 2026, 07:46 AM
Security Audit — agent-trust-hub — verify