skills/nvidia/skills/nv-generate-mr/Gen Agent Trust Hub

nv-generate-mr

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/run_mr.py uses subprocess.run to execute the upstream inference module scripts.diff_model_infer. This execution is restricted to a specific, predefined command structure using arguments staged by the wrapper itself.
  • [EXTERNAL_DOWNLOADS]: The skill fetches model weights from Hugging Face and clones a supporting repository from GitHub. These resources belong to the official NVIDIA organizations (NVIDIA-Medtech on GitHub and nvidia on Hugging Face), which are trusted sources.
  • [REMOTE_CODE_EXECUTION]: The setup instructions include installing Python dependencies via pip install -r requirements.txt from the cloned repository. This is a standard procedure for resolving the skill's documented requirements.
  • [DATA_EXFILTRATION]: The script retrieves the current Git commit hash of the local upstream repository to include in the execution metadata. This is a benign provenance-tracking activity and does not involve sensitive user credentials or data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 03:48 PM
Security Audit — agent-trust-hub — nv-generate-mr