skills/nvidia/skills/cuopt-user-rules/Gen Agent Trust Hub

cuopt-user-rules

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent on installing NVIDIA cuOpt packages.
  • Evidence: Mentions installation of cuopt, libcuopt, and cuopt-server via pip, conda, mamba, or Docker.
  • Context: These are official vendor packages provided by NVIDIA, the skill author.
  • [COMMAND_EXECUTION]: The skill defines rules for environment verification and shell interaction.
  • Evidence: Includes commands for curl http://localhost:8000/cuopt/health, find for library location, and import cuopt checks.
  • Safety Control: Explicitly mandates "Ask Before Running," requiring user permission for shell commands, scripts, and package installs. It also strictly forbids sudo and root-level operations.
  • [PROMPT_INJECTION]: The skill processes user-provided constraints and data to formulate optimization problems (Indirect Prompt Injection surface).
  • Ingestion points: User-supplied problem descriptions, constraint lists, and datasets.
  • Boundary markers: The skill requires a "MUST Verify Understanding" step and explicit "Clarify Data Requirements" prompts before generating code.
  • Capability inventory: User-space package installation, file-writing, and shell command execution.
  • Sanitization: Requires sanity checks on solver status and objective values to verify result validity.
  • [DATA_EXFILTRATION]: The skill manages user data during optimization tasks.
  • Evidence: Guidelines in the "Clarify Data Requirements" section instruct the agent to ask if a user has data or if a sample should be synthesized.
  • Context: The skill promotes safe data handling by documenting assumptions and minimizing unnecessary data access.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 10:58 AM
Security Audit — agent-trust-hub — cuopt-user-rules