tao-setup-nvidia-gpu-host
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [PRIVILEGE_ESCALATION]: The script requires and uses
sudoto perform system-level changes, including installing packages, modifying repository configurations in/etc/, and adding the current user to thedockergroup. This behavior is clearly documented as a requirement for the skill's core functionality. - [EXTERNAL_DOWNLOADS]: The script fetches repository configuration files, GPG keys, and packages from official NVIDIA and Docker domains (e.g.,
nvidia.com,nvidia.github.io,download.docker.com). These are established, well-known services directly related to the software being installed. - [COMMAND_EXECUTION]: The skill executes shell scripts and distribution-specific package managers (
apt-get,dnf,zypper) to manage host drivers and runtimes. The script requires the--installflag and provides a confirmation prompt to ensure administrative actions are intentional. - [INDIRECT_PROMPT_INJECTION]: The skill supports overriding minimum version requirements through model-specific configuration files. The implementation includes regex validation to ensure these version strings contain only numeric dot-separated components, which serves as a safeguard against command injection via configuration data.
Audit Metadata