jetson-video-benchmark
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local performance samples (e.g., AppEncPerf, AppDecPerf) and Python performance scripts (e.g., encode_perf.py) via a private CommandRunner using subprocess.Popen with shell=False. These executions are intended for benchmarking and are protected by a provenance system in
scripts/benchmark_provenance.pythat verifies file hashes, versions, and package ownership through live dpkg queries before launch. - [EXTERNAL_DOWNLOADS]: The skill allows downloading user-specified media for benchmarking. It implements strict validation of these URLs in
scripts/benchmark_controller.py, checking for valid HTTP/HTTPS schemes, hostname presence, and the absence of control characters or credentials in the URL string. All downloaded artifacts are hashed and stored in private workspaces. - [DYNAMIC_EXECUTION]: In
scripts/benchmark_provenance.py, a hardcoded Python program is executed via the command line to introspect the PyNvVideoCodec library environment. This is used solely for verifying the integrity and metadata of the installed vendor library. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user media and URLs which could contain malicious metadata or instructions. This risk is mitigated by the skill's architecture, which uses isolated private workspaces (mode 0700) to prevent data leakage and includes a strict scope-boundary instruction to refuse non-performance requests like objective quality measurements.
Audit Metadata