jetson-video-benchmark

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes system utilities such as dpkg-query, ldd, cmake, and ninja to verify the local Jetson environment and build benchmark samples. All subprocess calls are implemented with shell=False and use strictly validated argument vectors.
  • [REMOTE_CODE_EXECUTION]: Benchmarking involves the compilation and execution of C++ source code from the local NVIDIA Video Codec SDK. This risk is mitigated by a sophisticated provenance system that verifies the integrity of the SDK source files using dpkg --verify before compilation, ensuring that only unmodified, package-owned code is executed.
  • [EXTERNAL_DOWNLOADS]: The skill can download benchmarking media from user-supplied URLs. It implements validation checks on the URL structure and protocol (HTTP/HTTPS) and requires SHA-256 hash verification of the downloaded data before processing.
  • [PROMPT_INJECTION]: The skill ingests untrusted data through media URLs and benchmark recipes. It prevents indirect injection attacks by utilizing strict JSON schema validation, enforcing private workspaces with restricted permissions (0700), and avoiding shell execution for external inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 04:09 AM
Security Audit — agent-trust-hub — jetson-video-benchmark