tao-analyze-detection-kpi
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Pulls the TAO toolkit data-services container image from the official NVIDIA Container Registry (
nvcr.io). - [COMMAND_EXECUTION]: Executes analysis tasks via
docker runusing the TAO Data Services toolkit. The command includes typical GPU and networking flags (--gpus all,--network=host) necessary for the toolkit's operation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined YAML specifications for analysis parameters. It mitigates injection risks by employing a dedicated validation script (
scripts/verify_kpi_analyze_spec.py) that performs schema validation, path checks, and value range assertions before execution. - [OBFUSCATION]: The file
skill.oms.sigcontains a Base64-encoded in-toto metadata statement used for artifact signing and integrity verification. This is a standard security practice and not a malicious obfuscation attempt.
Audit Metadata