skills/nvidia/skills/add-benchmark/Gen Agent Trust Hub

add-benchmark

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides patterns for implementing code verification servers that use subprocess.run via Ray to compile and execute model-generated code. This behavior is the primary purpose of the benchmarking environment.
  • [EXTERNAL_DOWNLOADS]: Instructions describe auto-installing external tools using package managers like brew and custom shell scripts, as well as fetching datasets from a GitLab registry using provided CLI tools like ng_prepare_data.
  • [CREDENTIALS_UNSAFE]: The documentation guides users on configuring env.yaml with MLflow tracking tokens and GitLab API keys for dataset management, which is a standard approach for secret management in development workflows.
  • [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface (Category 8) by ingesting model-generated text for verification. It includes mitigation strategies such as stripping reasoning blocks (<think>) and using markdown-aware code extraction to isolate the executable content.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 06:14 AM
Security Audit — agent-trust-hub — add-benchmark