doca-upgrade
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust safety policy that requires explicit user confirmation before any upgrade or downgrade command is executed.
- [SAFE]: Administrative and hardware-touching actions, such as BlueField BFB reflashing or host package updates, are delegated to specialized skills (doca-hardware-safety, doca-setup) that manage these risks centrally.
- [SAFE]: All external references, including documentation and code examples, point to trusted, vendor-owned domains and repositories (nvidia.com and github.com/NVIDIA).
- [PROMPT_INJECTION]: The skill has an attack surface through processing external DOCA release notes to identify upgrade targets (Indirect Prompt Injection).
- Ingestion points: External release notes accessed via doca-public-knowledge-map.
- Boundary markers: The workflow requires the agent to report the discovered status to the user and obtain manual confirmation before proceeding.
- Capability inventory: Tooling for package management (apt, dpkg) and firmware modification (delegated to safety skills).
- Sanitization: Instructions prevent the agent from asserting release status from internal memory, requiring verification against live documentation.
Audit Metadata