fleet-health-report

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill refers to the official nvfleetint CLI tool and provides a download link to the vendor's GitHub releases page (https://github.com/NVIDIA/fleet-intelligence-client/releases). This is consistent with the skill's purpose and the vendor's identity.- [COMMAND_EXECUTION]: The skill uses the nvfleetint command-line utility to query fleet status and health data. These operations are scoped to the intended reporting functionality and include specific instructions to avoid exposing sensitive environment variables or API keys.- [PROMPT_INJECTION]: The skill processes live data from a fleet environment which could be influenced by external factors. This is a potential surface for indirect prompt injection.
  • Ingestion points: Fleet data enters the agent context via nvfleetint CLI commands (e.g., node list, alert summary) which output JSON as documented in SKILL.md.
  • Boundary markers: The workflow requires explicit resolution of scope and verification of profiles to limit the data context.
  • Capability inventory: The skill uses nvfleetint for API queries and shell commands (grep, date) for report validation and processing as documented in SKILL.md and references/workspace.md.
  • Sanitization: The skill explicitly mandates that all dynamic values must be HTML-escaped in the references/html-theme.md file and uses filename sanitization in references/workspace.md to prevent injection or path traversal attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 05:54 PM
Security Audit — agent-trust-hub — fleet-health-report