deepstream-import-vision-model
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches model configuration and weights from HuggingFace (
huggingface.co) and NVIDIA NGC (api.ngc.nvidia.com). These are established, trusted sources for AI model development. The downloads are performned using validated helper scripts (hf-download-config.sh,ngc-download.sh) that use HTTPS with TLSv1.2 and implement input validation to prevent path traversal. - [COMMAND_EXECUTION]: Executes shell commands via
subprocess.runin reporting scripts (md-to-html-pdf.py,render-mermaid-for-pdf.py) to invoke standard system utilities likewkhtmltopdfandmmdc. These are used for generating benchmark reports and diagrams as described in the skill's primary purpose. The scripts use non-shell execution (shell=False) and implement timeouts and boundary checks. - [SAFE]: The skill implements security best practices, including the use of isolated virtual environments for dependencies, mandatory zero-initialization of DeepStream parser structures to prevent uninitialized memory issues, and strict encoder policies that avoid prohibited codecs in favor of hardware-accelerated (NVENC) or standard LGPL fallbacks.
Audit Metadata