aiq-deploy
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone the AI-Q repository from NVIDIA's official GitHub account (https://github.com/NVIDIA-AI-Blueprints/aiq.git). This resource belongs to the trusted author and is used for its primary stated purpose of infrastructure deployment.
- [COMMAND_EXECUTION]: The skill utilizes standard DevOps tools including Git, Docker Compose, Helm, and Kubectl to manage local or cluster-based deployments. It also executes local management scripts (e.g., start_as_skill.sh, start_e2e.sh) found within the cloned repository to facilitate service startup and verification.
- [CREDENTIALS_UNSAFE]: The skill provides robust guidance for secret management. It includes a Python script in 'references/env-and-secrets.md' specifically designed to check for the presence of required API keys (e.g., NVIDIA_API_KEY, TAVILY_API_KEY) in the '.env' file without printing their values to the logs or terminal. It also includes instructions to verify that the '.env' file is correctly ignored by Git to prevent accidental exposure.
- [PROMPT_INJECTION]: No malicious prompt injection patterns, bypass markers, or instructions to override safety guidelines were detected. The skill uses instructional language consistent with technical operations and deployment workflows.
- [SAFE]: The skill demonstrates a strong security posture by including explicit warnings regarding authentication (REQUIRE_AUTH=false) and destructive operations (docker compose down -v), ensuring that users are informed of potential risks before execution.
Audit Metadata