vss-deploy-dense-captioning
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages authentication tokens (NGC_CLI_API_KEY, RTVI_VLM_API_KEY) using environment variables and local .env files. It includes instructions to set restrictive file permissions (chmod 600) and avoid committing these secrets to version control.
- [SAFE]: Remote resources, including Docker images and configuration files, are retrieved from official NVIDIA registries (nvcr.io) and GitHub repositories (github.com/NVIDIA-AI-Blueprints). These are well-known, trusted sources.
- [SAFE]: Privileged operations (using sudo) are performed with the non-interactive guard (-n) to prevent hanging in automated environments. The documentation explicitly advises against interactive sudo and suggests manual host-owner intervention if passwordless access is not available.
- [SAFE]: The skill includes a local utility script (Python) to modify the Docker Compose configuration file. This script is statically defined within the reference documentation and performs predictable, non-malicious file edits to adapt the configuration for standalone deployment.
- [SAFE]: While the skill processes external media (video files and RTSP streams) which could be a surface for indirect prompt injection, it follows standard service interaction patterns and provides recommended prompt templates for deterministic output.
Audit Metadata