hsb-flash
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of SSH to execute bash commands, manage Docker containers, and perform filesystem operations on remote NVIDIA devkits to coordinate the flashing procedure.
- [DYNAMIC_EXECUTION]: The skill implements a self-modification mechanism where it programmatically updates its own SKILL.md content based on external release notes fetched from a remote URL. It also dynamically sources session state from temporary shell scripts located at /tmp/.claude_hsb_flash_session/state.sh. This high-autonomy behavior poses a persistence or logic-override risk if the remote source is compromised.
- [EXTERNAL_DOWNLOADS]: The skill downloads FPGA bitstream files from NVIDIA's official artifactory (edge.urm.nvidia.com) and NGC API (api.ngc.nvidia.com), as well as from well-known services like Dropbox.
- [REMOTE_CODE_EXECUTION]: The skill clones release repositories from the official NVIDIA Holoscan GitHub organization and executes the contained tools and scripts within Docker containers on the remote host.
- [PROMPT_INJECTION]: The skill parses untrusted external data from a remote URL (RELEASE_NOTES.md) to influence its internal execution logic and configuration tables, creating a surface for indirect prompt injection.
Audit Metadata