holoscan-module-lifecycle

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the holoscan-cli tool and project templates from official package registries including PyPI and the NVIDIA package index.
  • [EXTERNAL_DOWNLOADS]: Clones project source code and configuration from the official NVIDIA Holoscan GitHub organization.
  • [COMMAND_EXECUTION]: Uses standard development utilities including uv, git, cmake, and dpkg to perform module scaffolding, building, and packaging tasks as intended by the skill's primary purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external module metadata, API contracts, and source code which could serve as an attack surface for indirect injection.
  • Ingestion points: Reads external configuration files including metadata.json, pyproject.toml, and module source code in SKILL.md and referenced development guides.
  • Boundary markers: While not using explicit LLM-specific boundary markers, the instructions emphasize isolating task-owned prefixes and working directories.
  • Capability inventory: Includes shell command execution via the holoscan CLI and standard build tools, file system writes during scaffolding, and network access for cloning repositories.
  • Sanitization: The instructions mandate schema validation of metadata against the official Holoscan schema and manual inspection of generated code and Git status before execution or committing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 12:32 PM