cutile-python
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a legitimate developer tool for GPU kernel development. Static analysis findings for eval() in example files (such as group_norm.py and conv2d_with_bias_dilation_groups.py) are false positives, as they refer to the PyTorch .eval() method for setting model states rather than the built-in Python eval() function.
- [EXTERNAL_DOWNLOADS]: The skill fetches source code from trusted repositories: * Clones TileGym from https://github.com/NVIDIA/TileGym.git. * Clones PyTorch from https://github.com/pytorch/pytorch.git.
- [COMMAND_EXECUTION]: The skill utilizes shell commands for essential developer tasks: * Executes git clone to acquire reference source code. * Runs python to execute generated scripts for kernel validation.
- [REMOTE_CODE_EXECUTION]: The skill implements a validation loop that executes dynamically generated Python code. This behavior is necessary for verifying the correctness of the GPU kernels and is performed locally within the testing environment.
- [PROMPT_INJECTION]: The skill's orchestration workflow processes user-supplied code to generate executable kernels, which presents a surface for indirect prompt injection. This is considered a low-severity risk inherent to the tool's function as a coding assistant.
Audit Metadata