fleet-health-report
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill refers to the official
nvfleetintCLI tool and provides a download link to the vendor's GitHub releases page (https://github.com/NVIDIA/fleet-intelligence-client/releases). This is consistent with the skill's purpose and the vendor's identity.- [COMMAND_EXECUTION]: The skill uses thenvfleetintcommand-line utility to query fleet status and health data. These operations are scoped to the intended reporting functionality and include specific instructions to avoid exposing sensitive environment variables or API keys.- [PROMPT_INJECTION]: The skill processes live data from a fleet environment which could be influenced by external factors. This is a potential surface for indirect prompt injection. - Ingestion points: Fleet data enters the agent context via
nvfleetintCLI commands (e.g.,node list,alert summary) which output JSON as documented inSKILL.md. - Boundary markers: The workflow requires explicit resolution of scope and verification of profiles to limit the data context.
- Capability inventory: The skill uses
nvfleetintfor API queries and shell commands (grep,date) for report validation and processing as documented inSKILL.mdandreferences/workspace.md. - Sanitization: The skill explicitly mandates that all dynamic values must be HTML-escaped in the
references/html-theme.mdfile and uses filename sanitization inreferences/workspace.mdto prevent injection or path traversal attacks.
Audit Metadata