skills/nvidia/skills/pva-doctor/Gen Agent Trust Hub

pva-doctor

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run and os.system in its helper scripts (notably scripts/materialize_sdk_references.py) to invoke system tools like pdftotext, command -v, and sha256sum. These are used to verify the local environment and process SDK documentation into Markdown format. Execution is gated by explicit logic to ensure paths stay within the workspace or SDK documentation root.
  • [EXTERNAL_DOWNLOADS]: The skill references NVIDIA's official documentation domains (e.g., docs.nvidia.com) and GitHub repositories (github.com/nvidia/pva-solutions) for installation guides and source code. These references are used for validation purposes or provided as remediation steps to the user.
  • [DATA_EXPOSURE]: The skill contains explicit instructions to redact and not record secrets, tokens, or private keys in its diagnostic reports. It probes target hardware permissions but does so without changing target state or exfiltrating sensitive credentials.
  • [SAFE]: The code implements strict path validation (e.g., in materialize_sdk_references.py) to prevent directory traversal or overwriting system files. It ensures that the generated reference corpus remains within the user-defined workspace and does not overlap with protected SDK or skill directories.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 05:37 PM