skills/nvidia/skills/mcore-testing/Gen Agent Trust Hub

mcore-testing

Pass

Audited by Gen Agent Trust Hub on Jun 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes a script, download_golden_values.py, to fetch baseline validation data from GitHub. Additionally, the test configuration in conftest.py is designed to automatically download missing test data if it is not present in the local environment.
  • [COMMAND_EXECUTION]: The documentation provides multiple shell command templates for executing distributed tests. These commands use uv, pytest, and torch.distributed.run to launch workloads, which is the intended behavior for reproducing CI/CD test failures and local development.
  • [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes external YAML recipes and JSON golden values that influence the execution flow and validation criteria of the tests.
  • Ingestion points: The agent reads configuration from tests/test_utils/recipes/ and data from tests/functional_tests/test_cases/.
  • Boundary markers: No explicit boundary markers or "ignore instructions" warnings are documented for the processed data.
  • Capability inventory: The skill is capable of executing shell scripts via bash and running Python modules through torch.distributed.run.
  • Sanitization: Analysis of the instructions does not show explicit sanitization or validation of the content within the YAML/JSON files beyond standard parsing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 12, 2026, 07:41 PM
Security Audit — agent-trust-hub — mcore-testing