skills/nvidia/skills/pva-spec/Gen Agent Trust Hub

pva-spec

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted requirements from plain-language descriptions, local files, and public URLs, creating a potential surface for indirect prompt injection. Ingestion points include user-supplied text and arbitrary URLs. While the skill instructs the agent not to invent behavior and uses a validation script for output, it lacks explicit boundary markers for interpolating external content into prompts.- [DYNAMIC_EXECUTION]: The skill executes a bundled Python utility, scripts/finalize_opgen_inputs.py, to validate configuration files and calculate integrity hashes. This script is part of the skill's core functionality for generating the final operator handoff.- [COMMAND_EXECUTION]: The skill uses the rg (ripgrep) utility to search through local SDK reference files and documentation to extract relevant architectural constraints and API details.- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch content from user-provided public URLs to gather behavior specifications, algorithm details, and reference documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 05:38 PM