tao-port-huggingface-model

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads resources from several remote locations including NVIDIA's official GitHub repositories, the NVIDIA Container Registry (nvcr.io), and the HuggingFace Hub. \n
  • Clones tao-core, tao-pytorch, tao-deploy, and tao-dataservices from NVIDIA organizations. \n
  • Pulls official TAO Toolkit container images from nvcr.io. \n
  • Downloads model weights and configurations from huggingface.co using the transformers library.\n- [COMMAND_EXECUTION]: Extensive use of shell commands and Docker operations to manage the integration lifecycle. \n
  • Uses docker run and docker exec to isolate development tasks inside containers. \n
  • Performs source installations using pip install and setup.py develop within these containers. \n
  • Uses git for repository and branch management.\n- [DYNAMIC_EXECUTION]: Runtime generation and execution of Python code are used to perform model inspection and validation. \n
  • Dynamically executes Python probes via docker exec to verify model compatibility and extract metadata. \n
  • Generates implementation code (e.g., adapters and trainers) that is executed as part of the TAO pipeline.\n- [CREDENTIALS_UNSAFE]: The skill manages sensitive tokens for HuggingFace and NGC. \n
  • Recommends the use of environment variables (HF_TOKEN, NGC_KEY) and secure docker login practices. \n
  • No hardcoded secrets were found in the skill content.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by processing external data from the HuggingFace Hub. \n
  • Ingestion points: Reads config.json and model weights from user-specified HuggingFace Model IDs. \n
  • Boundary markers: No explicit boundaries are placed around the fetched model metadata. \n
  • Capability inventory: The skill has high capabilities, including full filesystem access (via Docker bind-mounts), network operations, and arbitrary command execution. \n
  • Sanitization: There is no explicit sanitization of model configuration data before it is used to drive the implementation logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:56 AM
Security Audit — agent-trust-hub — tao-port-huggingface-model