doca-flow
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches official container images from the NVIDIA NGC registry (nvcr.io/nvidia/doca/doca). These downloads originate from a well-known vendor and are essential for providing the skill's documented development environment.
- [COMMAND_EXECUTION]: Employs standard system utilities such as pkg-config, ls, and docker to facilitate environment setup and verification. These commands are used as intended for developer workflows within the context of the DOCA SDK.
- [INDIRECT_PROMPT_INJECTION]: Ingests local system information to guide development tasks. Ingestion points: Command output from pkg-config and ls (TASKS.md). Boundary markers: Not explicitly implemented in raw command strings. Capability inventory: docker run, pkg-config, and ls (SKILL.md, TASKS.md). Sanitization: No specific filtering of system command output is defined, which is consistent with the trust model for local developer-oriented tools.
Audit Metadata