simready-foundation-create-package
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
assets/scripts/sr_pkg_sample/_conformance_writer.pyuses theeval()function within thebuild_asset_resultsfunction to parse string representations of list data (dependencies and failing requirements). Deserializing data usingeval()is a high-risk practice as it allows for arbitrary code execution if the input string can be influenced by an attacker, even if the data is currently generated by the tool's own validation engine.\n- [EXTERNAL_DOWNLOADS]: The environment setup scriptassets/scripts/setup_venv.shfacilitates the download of Python packages fromhttps://pypi.nvidia.com/. Given that the skill is authored by NVIDIA, this is recognized as an official and legitimate vendor resource. The script also supports user-provided package indices and local installation files.\n- [COMMAND_EXECUTION]: The skill's primary function is to orchestrate a technical workflow involving shell commands and Python scripts. It manages virtual environments and asset repositories through tools likesetup_venv.shandcreate_simready_package.py, performing necessary file operations for asset packaging.
Audit Metadata