skills/nvidia/skills/doca-pcc/Gen Agent Trust Hub

doca-pcc

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill instructs the agent to execute dmesg using sudo for driver debugging and notes that access to hardware devices (doca_dev) typically requires elevated privileges.
  • [COMMAND_EXECUTION]: Instructions guide the agent to run various system commands for environment discovery and building, including pkg-config, doca_caps, ls, and dmesg.
  • [INDIRECT_PROMPT_INJECTION]: The skill has the agent ingest data from system command outputs and local files (e.g., sample code in /opt/mellanox/doca/), creating a surface for indirect prompt injection if those sources contain malicious instructions.
  • Ingestion points: Command outputs from dmesg, pkg-config, and doca_caps; local files in /opt/mellanox/doca/ (TASKS.md).
  • Boundary markers: None explicitly defined for untrusted command output.
  • Capability inventory: Subprocess calls for pkg-config, doca_caps, dmesg, ls, and which (TASKS.md).
  • Sanitization: None described for external command output.
  • [OBFUSCATION]: The skill includes an artifact signature file (skill.oms.sig) containing a Base64-encoded payload that embeds internal URLs not visible in plain-text scanning.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 05:03 AM