vss-generate-video-calibration
Warn
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Installs the uv tool by fetching and executing a setup script from astral.sh using a shell pipe pattern.
- [COMMAND_EXECUTION]: Utilizes shell heredocs to dynamically generate and execute Python code blocks for calibration logic, which allows for complex operations without persisting script files in the repository.
- [COMMAND_EXECUTION]: Performs administrative actions including docker login and docker compose commands to manage containerized microservices.
- [CREDENTIALS_UNSAFE]: Facilitates the use of NGC_CLI_API_KEY and HuggingFace read tokens for container image and model access. The skill explicitly instructs the user to provide these credentials and includes logic intended to prevent their leakage into logs.
- [EXTERNAL_DOWNLOADS]: Retrieves sample video datasets from GitHub and pre-trained models from HuggingFace official repositories.
- [COMMAND_EXECUTION]: Recommends the use of setfacl to modify filesystem permissions on the host to enable container write access to project directories.
- [PROMPT_INJECTION]: The skill processes external data including video files, RTSP streams, and JSON configuration files.
- Ingestion points: File paths provided in references/videos.md and RTSP URLs provided in references/rtsp.md.
- Boundary markers: Absent; user-provided strings and file contents are used directly in shell commands and API requests.
- Capability inventory: Includes broad system access via Docker, network communication through Python requests, and filesystem operations.
- Sanitization: The skill does not describe validation or sanitization for the content of user-provided settings files or RTSP stream parameters.
Audit Metadata