tao-generate-image-grounding
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to execute the
auto_labelCLI tool, which is part of the NVIDIA TAO Toolkit. This command is the primary method for processing image-caption pairs and generating grounded annotations. - [EXTERNAL_DOWNLOADS]: The documentation includes instructions for setting up a vLLM server via Docker (
vllm/vllm-openai:latest) or pip (pip install vllm). These are well-known open-source resources used for hosting vision-language models. - [CREDENTIALS_UNSAFE]: The skill requires API keys for Gemini or HuggingFace access. It follows best practices by instructing users to provide these via environment variables or configuration placeholders, rather than hardcoding any secrets.
- [PROMPT_INJECTION]: The skill ingests untrusted image and caption data for processing by a VLM. While this represents a standard indirect prompt injection surface, the risk is minimal as the pipeline is designed for structured data generation (bounding boxes) and uses constrained output formats.
Audit Metadata