deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to "set credentials" and write env overrides directly into the authoritative .env (i.e., apply key/value pairs), which implies the agent will need to embed secret API keys/tokens verbatim into generated file-modification commands or outputs rather than only using environment variables or external CLIs — creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflow (references/env-overrides.md and references/base.md) instructs the agent to accept and write user-supplied remote LLM/VLM endpoint URLs (arbitrary external URLs) into the deployed config and to call external model endpoints (and even verifies tokens via curl in references/edge.md and downloads from NGC in references/ngc.md), so the agent will ingest untrusted third-party responses that can materially influence tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly verifies and pulls the gated Edge 4B model at runtime from Hugging Face (https://huggingface.co/api/models/nvidia/NVIDIA-Nemotron-Edge-4B-v2.1-EA-020126_FP8) and runs a vLLM container with --trust-remote-code, meaning required remote model content (fetched during runtime) can include and execute remote code that directly affects agent behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent/operator to run privileged and state-changing host commands (docker compose up/down, docker rm -f, chmod -R 777, and even sudo modprobe / sudo rm -rf), which require/ask for elevated privileges and can alter or weaken the host system state and security, so it is risky.