hsb-flash

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches remote content at runtime — it clones/uses the HSB release repo (e.g. https://github.com/nvidia-holoscan/holoscan-sensor-bridge.git) and fetches the public release notes (https://github.com/nvidia-holoscan/holoscan-sensor-bridge/blob/main/RELEASE_NOTES.md) to decide which repo/manifests to check out and to drive flashing actions (including git clone and docker build/run), so these URLs directly affect prompts and cause execution of remote code.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill content for high-entropy literal values that could serve as real credentials.

Flagged as secret:

• The Dropbox presigned file URLs in the bundled manifest YAMLs contain high-entropy rlkey/query tokens that grant access to downloadable bitstream files. These are literal, random-looking tokens embedded in URLs and therefore meet the "high-entropy value that provides access" definition. Examples (present in the skill files):
• scripts/v2.3.0/manifest_leopard_cpnx100.yaml: URL with rlkey=58a02jt1r3hxs2mgs1628dzop
• scripts/v2.3.1/manifest_leopard_cpnx100.yaml: same Dropbox URL (rlkey=58a02jt1r3hxs2mgs1628dzop)
• scripts/v2.5.0/manifest_leopard_cpnx100.yaml: Dropbox URL with rlkey=5uqdrugsu6o4ccq3u86hnbwhx (plus e=1&dl=1) These tokens allow direct file download and should be treated as secrets/credentials.

Ignored (not flagged) and why:

• UUIDs like fpga_uuid (e.g., 889b7ce3-65a5-4247-8b05-4ff1904c3359, f1627640-...) — identifiers, not access credentials.
• MD5 hashes and other checksums in manifests — integrity metadata, not secrets.
• Public URLs to GitHub, NGC/artifactory, edge.urm.nvidia.com (no embedded tokens) — not credentials.
• Example SSH targets, REMOTE_ROOT, IP addresses (e.g., ubuntu@10.0.0.1, 192.168.0.2) — usage examples/placeholders, not secrets.
• The sig/certificate material in skill.oms.sig (base64 rawBytes / certificate chain) — public certificate material (verification artifacts), not private keys or API secrets.
• Short/simple strings, sample passwords or placeholders (none present as real credentials) — per rules these are ignored.

Conclusion: the only items matching the "high-entropy literal value that provides access" definition are the Dropbox presigned URLs / rlkey tokens embedded in the manifest YAML files; these should be treated as secrets.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs the agent to run remote commands, checkout/patch repos, and permanently rewrite FPGA firmware on a connected devkit (with potential use of REMOTE_SUDO), which are irreversible, state-changing operations that can brick hardware and therefore risk compromising the machine's state.