tao-run-deft-pas
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runacross multiple scripts, includingscripts/check_pas_control_prereqs.pyandscripts/run_deft_docker_action.py, to interact with system tools like Docker, Kubectl, and virtualenv. This is the primary mechanism for environment verification and job submission. - [DYNAMIC_EXECUTION]: In
scripts/run_deft_cli.py, the skill usesos.execveto execute model-related commands (clip,embedding,tmm) within a controlled virtual environment. The script implements security measures, such as verifying the entrypoint file type and its SHA256 digest before execution. - [DATA_EXPOSURE_AND_EXFILTRATION]: The helper
scripts/check_pas_credentials.pychecks for the existence of necessary environment variables likeNGC_KEYandHF_TOKEN. The logic is designed to report only the presence of these variables and explicitly avoids logging or displaying their actual values. - [EXTERNAL_DOWNLOADS]: The workflow involves pulling container images from the NVIDIA NGC registry and base model weights from Hugging Face. These downloads are standard for the vendor's software ecosystem and are conducted after the user approves the run plan during the pre-flight phase.
Audit Metadata