amc-setup-calibration-stack
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Docker and Docker Compose commands to manage container lifecycles (
docker ps,docker login,docker compose up). These are standard for deployment tasks. - [EXTERNAL_DOWNLOADS]: The skill fetches the
auto-magic-calibrepository from GitHub and theVGGT-1B-Commercialmodel from Hugging Face. These are legitimate resources from well-known services associated with the skill's purpose. - [CREDENTIALS_SAFE]: Secure credential handling is implemented. The NGC API key and Hugging Face token are collected via the host's question mechanism and passed to tools through standard input or environment variables to prevent exposure in process lists.
- [SAFE_PRACTICE]: The skill includes a fail-fast image access check using
docker manifest inspectand ensures sensitive configuration files (.env) are created with restricted permissions (chmod 600).
Audit Metadata