simready-foundation-create-package

Warn

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script assets/scripts/sr_pkg_sample/_conformance_writer.py uses the eval() function within the build_asset_results function to parse string representations of list data (dependencies and failing requirements). Deserializing data using eval() is a high-risk practice as it allows for arbitrary code execution if the input string can be influenced by an attacker, even if the data is currently generated by the tool's own validation engine.\n- [EXTERNAL_DOWNLOADS]: The environment setup script assets/scripts/setup_venv.sh facilitates the download of Python packages from https://pypi.nvidia.com/. Given that the skill is authored by NVIDIA, this is recognized as an official and legitimate vendor resource. The script also supports user-provided package indices and local installation files.\n- [COMMAND_EXECUTION]: The skill's primary function is to orchestrate a technical workflow involving shell commands and Python scripts. It manages virtual environments and asset repositories through tools like setup_venv.sh and create_simready_package.py, performing necessary file operations for asset packaging.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 17, 2026, 05:57 AM
Security Audit — agent-trust-hub — simready-foundation-create-package