omniverse-realtime-viewer
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Setup instructions in 'references/cloud-deployment/README.md' and 'references/cloud-assets/README.md' include the use of 'sudo' for installing system packages (apt-get), managing directory permissions (mkdir, chown), and running services like Caddy. These commands acquire elevated permissions and should be reviewed for least-privilege compliance.
- [CREDENTIALS_UNSAFE]: The 'references/cloud-assets/README.md' file contains hardcoded default credentials ('minioadmin') in example commands for setting up a local MinIO object storage server. While intended for local testing, hardcoding credentials in scripts is a risk if moved to production.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to fetch binaries, scripts, and large data assets from several external domains including 'dl.min.io' (for MinIO), 'github.com' (for Caddy), 'huggingface.co' (for USD assets), and 'cloudfront.net' (for NVIDIA sample data). These are well-known technology and service providers.
- [REMOTE_CODE_EXECUTION]: Instructions describe downloading binary executables and archives from remote servers (e.g., MinIO and Caddy) and subsequently executing them ('chmod +x' or 'tar' extraction). This pattern represents a remote code execution vector common in infrastructure automation.
Audit Metadata