nemotron-customize
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation and instructions explicitly prohibit hardcoding secrets, require the redaction of credentials (API keys, tokens) during file inspection, and mandate the use of environment variables for authentication.
- [EXTERNAL_DOWNLOADS]: The skill facilitates data acquisition from well-known services and integrates with established cloud providers for translation services. These references are documented neutrally as they target recognized technology organizations and services.
- [COMMAND_EXECUTION]: Execution is strictly scoped to repository-native tools via the environment manager and process replacement methods. The instructions include safety checks to prevent broad environment dumps or unauthorized command execution.
- [PROMPT_INJECTION]: The skill handles untrusted user data for training and evaluation. While this creates an indirect prompt injection surface, the risk is managed by the inclusion of dedicated curation steps which provide structured filtering for data quality.
- Ingestion points: User datasets are ingested via the curation steps (documented in references/context/curator-data-acquisition.txt).
- Boundary markers: Data is processed using structured configurations that define field mappings.
- Capability inventory: Execution of repo-internal scripts and process replacement tools.
- Sanitization: Integrated filtering and curation workflows are available for data preparation.
Audit Metadata