holoscan-module-lifecycle
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
holoscan-clitool and project templates from official package registries including PyPI and the NVIDIA package index. - [EXTERNAL_DOWNLOADS]: Clones project source code and configuration from the official NVIDIA Holoscan GitHub organization.
- [COMMAND_EXECUTION]: Uses standard development utilities including
uv,git,cmake, anddpkgto perform module scaffolding, building, and packaging tasks as intended by the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes external module metadata, API contracts, and source code which could serve as an attack surface for indirect injection.
- Ingestion points: Reads external configuration files including
metadata.json,pyproject.toml, and module source code inSKILL.mdand referenced development guides. - Boundary markers: While not using explicit LLM-specific boundary markers, the instructions emphasize isolating task-owned prefixes and working directories.
- Capability inventory: Includes shell command execution via the
holoscanCLI and standard build tools, file system writes during scaffolding, and network access for cloning repositories. - Sanitization: The instructions mandate schema validation of metadata against the official Holoscan schema and manual inspection of generated code and Git status before execution or committing.
Audit Metadata