tao-generate-image-grounding
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input data (text captions and images) from JSONL files, which are subsequently interpreted by a Vision-Language Model (VLM).
- Ingestion points: The
data.input_jsonlfile processed inSKILL.mdand defined inreferences/configuration.md. - Boundary markers: No explicit prompt delimiters or "ignore embedded instructions" warnings are provided in the pipeline steps to separate instructions from input data.
- Capability inventory: The skill executes the
auto_labeltool via Bash and writes results to the local filesystem. - Sanitization: No sanitization or filtering of the input JSONL content is described in the provided instructions.
- [COMMAND_EXECUTION]: The skill is built around executing CLI tools and managing containerized services.
- Executes the
auto_label generatecommand within the TAO Toolkit container. - Provides instructions for running Docker commands (
docker run --runtime nvidia) to host local inference servers using thevllm-openaiimage. - [EXTERNAL_DOWNLOADS]: The skill references and downloads resources from well-known and trusted sources.
- Pulls official Docker images from the NVIDIA Container Registry (
nvcr.io/nvidia/tao/tao-toolkit). - Recommends pulling the
vllm/vllm-openaiimage from Docker Hub and installing thevllmpackage viapipfrom the official vLLM project repository.
Audit Metadata