dgx-spark-skills
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule to execute system discovery commands (e.g.,lsblk,findmnt,uname,nproc) to gather hardware capacity and identity information. These operations are restricted to read-only inventory tools and are protected by explicit user authorization rules defined in the workflow files. - [DATA_EXFILTRATION]: The skill includes a dedicated redaction script (
redact-support-text.py) designed to identify and mask sensitive information such as API keys, private keys, and authorization tokens before logs are shared with support channels. It explicitly warns against uploading raw logs and requires manual review of all staged evidence. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration and repository metadata from official NVIDIA domains (e.g.,
developer.download.nvidia.com). These downloads are used for legitimate purposes like setting up thedgx-spark-fieldiagpackage and are documented as standard administrative procedures.
Audit Metadata