tao-finetune-clip

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: No hardcoded credentials or sensitive data exfiltration detected. Example S3 paths are generic placeholders for user configuration.- [REMOTE_CODE_EXECUTION]: Container images are sourced from the official NVIDIA NGC registry (nvcr.io), which is a trusted service for NVIDIA tool deployment. Shell commands in the documentation are scoped to running model operations within these containers.- [PROMPT_INJECTION]: The skill processes external data including image captions and prompts. While specific boundary markers are not used in the documentation templates, the processing is performed by established TAO tools within a sandboxed container. The documentation also provides explicit warnings against using the TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1 override with untrusted checkpoints, mitigating risks associated with arbitrary object unpickling.- [SAFE]: The digital signature bundle (skill.oms.sig) uses standard base64 encoding to package cryptographic verification material for supply chain security. This is an integrity feature and not a malicious attempt to hide content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 02:39 PM
Security Audit — agent-trust-hub — tao-finetune-clip