skills/nvidia/skills/nv-segment-ct/Gen Agent Trust Hub

nv-segment-ct

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches a ~832 MB model bundle from the official NVIDIA repository on Hugging Face (nvidia/NV-Segment-CT) using the huggingface-cli tool. It also downloads a sample medical imaging dataset (~1.5 GB) from the MONAI Project's S3 mirror (msd-for-monai.s3-us-west-2.amazonaws.com). Both sources are associated with trusted organizations and well-known services.
  • [COMMAND_EXECUTION]: The documentation and manifest instruct the agent to execute shell commands to install Python dependencies via pip and download external assets. These operations are standard for the skill's stated purpose of setting up a medical imaging inference environment.
  • [REMOTE_CODE_EXECUTION]: The entrypoint script (scripts/run_vista3d.py) modifies sys.path to dynamically import and execute logic from the downloaded Hugging Face bundle. While this pattern involves executing remote-sourced code, the source is a specific, official vendor repository.
  • [DATA_EXFILTRATION]: No evidence of unauthorized data transmission was detected. Network activity is limited to downloading required assets from trusted domains. The skill's primary focus is local processing of medical imaging volumes.
  • [PROMPT_INJECTION]: The skill instructions do not contain any patterns attempting to override agent behavior, bypass safety filters, or extract system prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 07:15 PM
Security Audit — agent-trust-hub — nv-segment-ct