vss-search-archive
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard shell utilities such as
curl,jq, anduuidgento interact with VSS agent APIs, Elasticsearch, and Video Storage Toolkit (VST) services. These operations are restricted to the user-provided$HOST_IPand standard VSS service ports (e.g., 8000, 9200). - [EXTERNAL_DOWNLOADS]: The skill retrieves configuration data and container images from trusted NVIDIA-owned resources, including the NGC registry (
nvcr.io) and official GitHub organizations. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it processes untrusted metadata from video files and RTSP streams.
- Ingestion points: Data enters the system via file uploads and RTSP stream registration endpoints in the VSS backend.
- Boundary markers: There are no explicit delimiters or instruction isolation markers described for when the agent summarizes search results or video content.
- Capability inventory: The agent is capable of executing network requests via
curl, writing files to/tmp, and performing visual inspection of screenshots. - Sanitization: The skill does not document specific sanitization or validation logic for external metadata before it is processed by the agent's language model.
Audit Metadata