tao-generate-referring-expressions

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official NVIDIA TAO Toolkit container image (nvcr.io/nvidia/tao/tao-toolkit) and the vLLM Docker image (vllm/vllm-openai) for its execution environment. These are provided by a trusted organization and a well-known service respectively.
  • [DATA_EXFILTRATION]: The skill transmits image data and bounding box metadata to vision-language model (VLM) endpoints, such as Google Gemini or user-specified OpenAI-compatible services. This communication is the core intended functionality for generating annotations and is clearly documented in the configuration and setup instructions.
  • [COMMAND_EXECUTION]: The skill utilizes the auto_label command-line utility from the TAO Toolkit to orchestrate the pipeline. These commands are executed within the context of the provided Docker container to process local datasets.
  • [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface as it processes external image files and KITTI-formatted labels to construct VLM queries.
  • Ingestion points: Untrusted data enters the context via data.image_dir, data.kitti_label_dir, and data.input_annotations_jsonl as defined in SKILL.md and references/configuration.md.
  • Boundary markers: The pipeline employs a structured JSONL format (annotations.jsonl) for intermediate outputs, which helps maintain data separation between processing steps.
  • Capability inventory: The skill uses the auto_label tool to perform file-system operations and network API calls to VLM providers.
  • Sanitization: The skill performs basic validation of KITTI label files, requiring at least 8 fields per line before processing, which provides a layer of input filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 05:48 PM
Security Audit — agent-trust-hub — tao-generate-referring-expressions