nemotron-retrieval-recipes
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses
uv runand standard shell commands to interact with local repository files and thenemotronCLI. All actions are scoped to the project checkout, and instructions explicitly warn against running expensive GPU, Docker, or API work without direct user approval. - [DATA_EXFILTRATION]: The skill contains strong safety guidelines regarding secrets. It explicitly instructs the agent to never ask users to paste
NVIDIA_API_KEYorNGC_API_KEYand instead use environment variables or.envfiles. It also warns about data privacy when using Stage 0 SDG (Synthetic Data Generation) which involves sending text to external APIs. - [EXTERNAL_DOWNLOADS]: The skill references official NVIDIA/Nemotron resources, such as datasets on Hugging Face (
hf://nvidia/...) and Docker images from NVIDIA's registry (nvcr.io/nim/nvidia/...). These are verified vendor resources and do not present a security risk. - [COMMAND_EXECUTION]: Shell commands are used for local operations like running help, dry-runs, and standard training stages. The skill prioritizes dry-runs (
-dflag) to validate configurations before actual execution. No unauthorized or obfuscated commands were detected. - [PROMPT_INJECTION]: The skill does not contain any instructions attempting to bypass safety filters or override agent behavior. The instructions are focused entirely on the domain-specific tasks of retrieval recipe management.
Audit Metadata