tao-port-huggingface-model
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads resources from several remote locations including NVIDIA's official GitHub repositories, the NVIDIA Container Registry (nvcr.io), and the HuggingFace Hub. \n
- Clones
tao-core,tao-pytorch,tao-deploy, andtao-dataservicesfrom NVIDIA organizations. \n - Pulls official TAO Toolkit container images from
nvcr.io. \n - Downloads model weights and configurations from
huggingface.cousing thetransformerslibrary.\n- [COMMAND_EXECUTION]: Extensive use of shell commands and Docker operations to manage the integration lifecycle. \n - Uses
docker runanddocker execto isolate development tasks inside containers. \n - Performs source installations using
pip installandsetup.py developwithin these containers. \n - Uses
gitfor repository and branch management.\n- [DYNAMIC_EXECUTION]: Runtime generation and execution of Python code are used to perform model inspection and validation. \n - Dynamically executes Python probes via
docker execto verify model compatibility and extract metadata. \n - Generates implementation code (e.g., adapters and trainers) that is executed as part of the TAO pipeline.\n- [CREDENTIALS_UNSAFE]: The skill manages sensitive tokens for HuggingFace and NGC. \n
- Recommends the use of environment variables (
HF_TOKEN,NGC_KEY) and securedocker loginpractices. \n - No hardcoded secrets were found in the skill content.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by processing external data from the HuggingFace Hub. \n
- Ingestion points: Reads
config.jsonand model weights from user-specified HuggingFace Model IDs. \n - Boundary markers: No explicit boundaries are placed around the fetched model metadata. \n
- Capability inventory: The skill has high capabilities, including full filesystem access (via Docker bind-mounts), network operations, and arbitrary command execution. \n
- Sanitization: There is no explicit sanitization of model configuration data before it is used to drive the implementation logic.
Audit Metadata