tao-finetune-cosmos-reason
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill relies on official NVIDIA resources, including Docker images from 'nvcr.io/nvidia/tao' and 'nvcr.io/nvidia/pytorch', and source code from the official 'NVIDIA/cosmos-framework' GitHub repository. As the author is NVIDIA, these are trusted vendor-controlled sources.
- [SAFE]: Credential handling follows security best practices. The skill instructs users to utilize environment variables or secure '.env' files for sensitive tokens (like 'HF_TOKEN') rather than hardcoding them in scripts or configuration files.
- [SAFE]: Runtime library modifications (monkey patching) in 'scripts/evaluate_wts_gb300.py' and 'scripts/train_wts_gb300.py' are used for legitimate hardware compatibility workarounds, specifically to provide cuDNN engine fallbacks and video decoding optimizations for NVIDIA GB300 GPUs.
- [SAFE]: Shell command execution via 'subprocess' and 'docker run' is restricted to the skill's primary functional requirements: model training, evaluation, and checkpoint format conversion. The commands used for dataset preflight and hardware setup are part of the intended model developer workflow.
Audit Metadata