holoscan-install-source
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a GPG security key and repository configuration from official NVIDIA GitHub Pages (nvidia.github.io). This is a standard and safe operation for repository management.
- [COMMAND_EXECUTION]: Executes commands with elevated privileges (sudo) to install the NVIDIA Container Toolkit, update package lists, and configure the Docker runtime. These are necessary steps for setting up a GPU-accelerated build environment.
- [COMMAND_EXECUTION]: Instructs the agent to clone the official Holoscan SDK repository and execute the provided build script (./run build).
- [PROMPT_INJECTION]: The skill processes information from an external documentation site (docs.nvidia.com) to determine build parameters. While this creates an indirect prompt injection surface, the risk is mitigated by the source being a trusted vendor domain. Evidence: (1) Ingestion: docs.nvidia.com/holoscan/sdk-user-guide/sdk_installation.html referenced in SKILL.md; (2) Boundaries: Absent; (3) Capabilities: Subprocess execution, file-write, and sudo; (4) Sanitization: Absent.
Audit Metadata