skills/nvidia/skills/codonfm-embed/Gen Agent Trust Hub

codonfm-embed

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill instructions and associated scripts do not contain any malicious patterns, obfuscation, or unauthorized data access attempts. The design emphasizes a read-only validation step before any model execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CSV files, creating an indirect prompt injection surface. Evidence: 1. Ingestion points: The scripts/validate_inputs.py script reads the input CSV file. 2. Boundary markers: Instructions explicitly separate the validation phase from command preparation and execution. 3. Capability inventory: The skill involves reading CSV and ZIP files and executing shell commands for model inference. 4. Sanitization: The validation script enforces strict character-level checks on the ref_seq field, allowing only valid DNA/RNA bases (A, C, G, T, U), which effectively prevents instruction embedding in the sequence data.
  • [EXTERNAL_DOWNLOADS]: The skill references model weights and source code from official NVIDIA repositories on HuggingFace and GitHub. These references are documented neutrally as standard requirements for using the public CodonFM toolkit.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 11:40 AM