rtvi-cv-scaffold-vss-service
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and utilizes shell commands including
docker,docker-compose, andpython3for building and deploying the perception service. A generated utility,tools/kafka_smoketest.py, usesdocker execto perform connectivity checks against Kafka containers.\n- [EXTERNAL_DOWNLOADS]: The skill references the officialNVIDIA-AI-BlueprintsGitHub organization for blueprint code and thenvcr.ioregistry for DeepStream base images. These resources are provided by the vendor.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a service that ingests video and Kafka metadata, creating a potential attack surface for indirect prompt injection. However, the agent's role is restricted to infrastructure scaffolding and connectivity testing.\n - Ingestion points: The generated
tools/kafka_smoketest.pyreads data from themdx-rawKafka topic.\n - Boundary markers: The validation script checks for message presence and length without parsing or executing the payload content.\n
- Capability inventory: The skill uses
docker execandsubprocess.runfor service validation.\n - Sanitization: The generated scripts include validation for container names and server addresses to prevent command injection via tool arguments.
Audit Metadata