skills/nvidia/skills/bump-dependency/Gen Agent Trust Hub

bump-dependency

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates and executes a local monitoring script (/tmp/watchdog-<PR>.sh) using the Monitor tool. This script polls the GitHub API via the gh CLI to track the status of CI/CD runs. It also uses standard git and gh commands for repository management and PR interactions.
  • [EXTERNAL_DOWNLOADS]: Fetches repository information and CI/CD logs from GitHub (github.com/NVIDIA/TransformerEngine.git, NVIDIA-NeMo/Megatron-Bridge) using git and gh. These are vendor-controlled resources belonging to the skill author.
  • [SAFE]: No obfuscation, data exfiltration, or malicious persistence mechanisms were detected. The use of signed commits and established CI/CD workflows aligns with industry security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 06:14 AM
Security Audit — agent-trust-hub — bump-dependency