tao-finetune-cosmos-reason

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes system commands to perform its tasks. The script scripts/prepare_cosmos3_vlm_checkpoint.py uses subprocess.run to call git clone and docker run. Additionally, the inference and quantize actions in references/skill_info.yaml use Python heredocs to execute CLI tools like cosmos-rl-inference and cosmos-rl-quantize. These are functional requirements for model training and conversion.
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources from external repositories. It clones the cosmos-framework repository from NVIDIA's official GitHub and pulls a PyTorch container image from NVIDIA's container registry. It also interacts with Hugging Face to download the Cosmos3-Nano model weights. These external sources are associated with the vendor or are well-known technology providers.
  • [SAFE]: No malicious patterns or security vulnerabilities were identified. The handling of sensitive information, such as the HF_TOKEN for Hugging Face authentication, follows standard security best practices by utilizing environment variables and container secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 05:48 PM
Security Audit — agent-trust-hub — tao-finetune-cosmos-reason