skills/nvidia/elements/agent-upkeep/Gen Agent Trust Hub

agent-upkeep

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs routine software development operations using pnpm and node, including running CI pipelines, executing unit tests, and applying linting fixes. It invokes a local discovery script, scripts/select-task.js, which uses git to programmatically identify maintenance candidates. These actions are strictly limited by the skill's diff caps and hard constraints, ensuring they remain within the scope of codebase maintenance.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process code and test files from the repository to identify and fix issues. While this processes untrusted data, the risk is mitigated by the deterministic task selection and strict verification requirements.
  • Ingestion points: Reads source code from projects/, unit tests (*.test.ts), and JSON metadata such as coverage-summary.json and package.json.
  • Boundary markers: None explicitly defined for separating code content from instructions in the prompt.
  • Capability inventory: The agent can execute shell commands via mise and pnpm, modify files to create pull requests, and perform git operations.
  • Sanitization: The selection script uses execFile for command execution, preventing shell injection by passing arguments as a list rather than a shell string.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 05:54 AM
Security Audit — agent-trust-hub — agent-upkeep