deepstream-import-vision-model

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads model weights, configurations, and metadata from HuggingFace (huggingface.co) and NVIDIA NGC (api.ngc.nvidia.com). These are trusted platforms and the downloads are central to the skill's functionality.
  • [COMMAND_EXECUTION]: Executes standard NVIDIA SDK binaries including trtexec, deepstream-app, and GStreamer utilities (gst-launch-1.0) to perform model optimization and pipeline validation.
  • [COMMAND_EXECUTION]: Uses the Python subprocess module with shell=False to invoke external report generation tools like wkhtmltopdf and the Mermaid CLI (mmdc). These calls are guarded and operate on local, skill-generated content.
  • [EXTERNAL_DOWNLOADS]: Installs standard Python libraries (e.g., optimum, transformers, onnxruntime) and system packages (wkhtmltopdf, mediainfo) required for the pipeline. These are standard dependencies for computer vision development.
  • [SAFE]: The skill implements several security best practices, such as validating model names against regular expressions, verifying that cleanup operations are restricted to specific project subdirectories, and checking that image embedding in reports does not perform path traversal.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 06:14 AM
Security Audit — agent-trust-hub — deepstream-import-vision-model