nemotron-voice-agent-builder
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is well-architected and follows security best practices for scaffolding complex AI projects.
- [COMMAND_EXECUTION]: Host probing commands in references/preflight.md (e.g., nvidia-smi, cat /proc/meminfo) are used legitimately to detect hardware capabilities for local model deployment and do not pose a security risk.
- [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive credentials like NVIDIA_API_KEY and HF_TOKEN by instructing the agent to use environment variables and .env files, specifically advising against writing real secrets to disk.
- [PRIVILEGE_ESCALATION]: The instructions explicitly discourage the use of sudo for container operations and file management, recommending standard user permissions.
- [EXTERNAL_DOWNLOADS]: All external resources, including model weights from Hugging Face and container images from NVIDIA NGC, are sourced from trusted vendor domains and official repositories.
- [INDIRECT_PROMPT_INJECTION]: The skill includes robust mitigations for the generated agents, such as guidelines in references/domain/agent-behavior.md to strip markdown, code, and machine identifiers from spoken output, reducing the risk of data leakage or confusing instructions being processed by the TTS engine.
Audit Metadata