pva-setup
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system-level commands to manage the development environment.
- Invokes package managers (e.g.,
apt) on the Ubuntu development host to install build dependencies and SDK components. - Executes commands on a remote Jetson board (Arm64 L4T) via SSH to install runtimes and check BSP versions.
- [PRIVILEGE_ESCALATION]: The skill utilizes administrative privileges to perform its tasks.
- Employs
sudofor registering package repositories and installing system-wide SDK and compiler packages. - These actions are declared and necessary for the core functionality of environment setup.
- [EXTERNAL_DOWNLOADS]: The skill fetches external content from verified sources.
- Downloads SDK installers and documentation from NVIDIA's official domains (
docs.nvidia.com). - Clones source code from the official NVIDIA PVA Solutions repository on GitHub (
github.com/nvidia/pva-solutions.git). - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection through data ingestion.
- Processes external installation guides (URLs or local files) to determine installation steps, package names, and versions.
- Capability inventory includes file writing, shell execution, and network operations.
- Mitigation is provided by instructions to verify guide/artifact matching and inspecting package metadata before installation.
Audit Metadata