Skills
Navigate
skills/nvidia/cosmos-framework/cosmos3-setup/Gen Agent Trust Hub

cosmos3-setup

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the installation script for uv, a well-known Python package manager, from Astral's official domain (astral.sh).
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the uv tool by piping a remote script to the shell (curl | sh), which is the official installation method for this widely-recognized service.
  • [COMMAND_EXECUTION]: Standard system package installation commands using sudo apt-get are provided to install necessary dependencies such as ffmpeg, git-lfs, and development libraries.
  • [CREDENTIALS_UNSAFE]: The skill mentions HuggingFace authentication and the HF_TOKEN environment variable for model checkpoint access but does not contain hardcoded credentials or unsafe secret handling practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 10:45 PM
Security Audit — agent-trust-hub — cosmos3-setup