nemotron-retrieval-recipes

Pass

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill uses uv run and standard shell commands to interact with local repository files and the nemotron CLI. All actions are scoped to the project checkout, and instructions explicitly warn against running expensive GPU, Docker, or API work without direct user approval.
  • [DATA_EXFILTRATION]: The skill contains strong safety guidelines regarding secrets. It explicitly instructs the agent to never ask users to paste NVIDIA_API_KEY or NGC_API_KEY and instead use environment variables or .env files. It also warns about data privacy when using Stage 0 SDG (Synthetic Data Generation) which involves sending text to external APIs.
  • [EXTERNAL_DOWNLOADS]: The skill references official NVIDIA/Nemotron resources, such as datasets on Hugging Face (hf://nvidia/...) and Docker images from NVIDIA's registry (nvcr.io/nim/nvidia/...). These are verified vendor resources and do not present a security risk.
  • [COMMAND_EXECUTION]: Shell commands are used for local operations like running help, dry-runs, and standard training stages. The skill prioritizes dry-runs (-d flag) to validate configurations before actual execution. No unauthorized or obfuscated commands were detected.
  • [PROMPT_INJECTION]: The skill does not contain any instructions attempting to bypass safety filters or override agent behavior. The instructions are focused entirely on the domain-specific tasks of retrieval recipe management.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 17, 2026, 08:13 AM
Security Audit — agent-trust-hub — nemotron-retrieval-recipes