Skills
Navigate
skills/nvidia-tao/tao-skill-bank/tao-run-on-brev/Gen Agent Trust Hub

tao-run-on-brev

Fail

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The SKILL.md file contains instructions to install a secondary agent skill using the command curl -fsSL https://raw.githubusercontent.com/brevdev/brev-cli/main/scripts/install-agent-skill.sh | bash. This pattern downloads and executes a remote shell script directly in the local environment without prior verification.
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources and installation scripts from raw.githubusercontent.com/brevdev/. Although this domain is associated with the service described in the skill, it is an external source that is not recognized as a trusted organization within the established security framework.
  • [COMMAND_EXECUTION]: The skill provides templates for executing arbitrary shell commands and Docker operations on remote instances via the brev exec command. This tool acts as a wrapper for remote shell execution, allowing the agent to perform complex operations on external GPU hardware.
  • [METADATA_POISONING]: There is an inconsistency in versioning between the skill's YAML frontmatter (0.2.0) and the skill-card.md documentation (0.1.0), which could mislead users or automated systems regarding the skill's deployment state.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/brevdev/brev-cli/main/scripts/install-agent-skill.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 17, 2026, 02:56 AM
Security Audit — agent-trust-hub — tao-run-on-brev