skills/nvidia/megatron-lm/mcore-cicd/Gen Agent Trust Hub

mcore-cicd

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous helper commands using the GitHub CLI (gh) to view pull requests, list workflow runs, and download build artifacts. These are standard development workflows for the target project.
  • [COMMAND_EXECUTION]: The skill documents the use of a project-specific script tools/trigger_internal_ci.py. While the skill notes this script performs a destructive force-push to a specific internal branch, it includes clear warnings and instructions to use the --dry-run flag first to verify the destination, representing a documented administrative task rather than a hidden malicious behavior.
  • [EXTERNAL_DOWNLOADS]: The skill references container image registries hosted on AWS ECR (766267172432.dkr.ecr.us-east-1.amazonaws.com) and GCP Artifact Registry (us-east4-docker.pkg.dev), which are standard for NVIDIA's CI infrastructure in this project context.
  • [SAFE]: Instructions for reading CI logs involve standard Linux utilities like grep, wc, and sed. The use of sed to read chunks of logs is a recommended best practice for handling large files in an agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 01:41 PM
Security Audit — agent-trust-hub — mcore-cicd