physical-ai-video-data-augmentation
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads model weights and demo assets from trusted organizations and well-known services, including NVIDIA's Hugging Face repositories and Google Storage. These downloads are legitimate requirements for the Cosmos and SeedVR2 models used in the workflow.
- [COMMAND_EXECUTION]: The orchestrator executes local bash and Python scripts to manage the lifecycle of OSMO workflows. The Python script
scripts/pre_submit_guard.pyuses subprocess calls to interact with theosmoCLI; these calls use list-based arguments without shell invocation, preventing command injection. - [CREDENTIALS_UNSAFE]: The skill uses platform-standard mechanisms for secret management. It utilizes the
osmo credential setcommand to store API keys for Hugging Face and NGC. It does not contain any hardcoded secrets; credentials are provided by the user via environment variables or interactive prompts as needed. - [DATA_EXFILTRATION]: Network operations are restricted to authorized communication with NVIDIA NIM endpoints, NGC registries, and Hugging Face. There are no patterns suggesting the exfiltration of sensitive local data to unauthorized external domains.
- [REMOTE_CODE_EXECUTION]: While the skill submits workflows that execute code in remote containers, these containers are NVIDIA-provided base images and specialized workers (
nvcr.io/nvidia/paidf-*). This is consistent with the intended purpose of a workflow orchestrator.
Audit Metadata