Skills
Navigate
skills/nvidia/nemoclaw/nemoclaw-maintainer-validate-launchable/Gen Agent Trust Hub

nemoclaw-maintainer-validate-launchable

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web pages, environment metadata, and workflow artifacts while possessing command execution capabilities.
  • Ingestion points: Launchable web pages, GCE instance metadata, and GitHub workflow artifacts (launchable-e2e.json).
  • Boundary markers: The skill contains explicit instructions to treat all external evidence as untrusted and not as agent instructions.
  • Capability inventory: The skill uses brev-cli for shell command execution, reads system files (/etc/nemoclaw/provision.json), and performs network operations to download artifacts.
  • Sanitization: Instructions require the agent to redact credentials from logs and screenshots and rotate/revoke inference keys after use.
  • [EXTERNAL_DOWNLOADS]: The skill downloads configuration and validation artifacts from the organization's official GitHub repository.
  • Fetches launchable-e2e.json from the NVIDIA/NemoClaw repository on GitHub.
  • [COMMAND_EXECUTION]: The skill executes shell scripts and test files located within the repository being validated.
  • Runs tools/e2e/brev-launchable-e2e.sh and test/e2e/live/full-e2e.test.ts to perform end-to-end validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 01:18 PM
Security Audit — agent-trust-hub — nemoclaw-maintainer-validate-launchable