Skills
Navigate
skills/open-edge-platform/skills/metro-ai-app-recipe/Gen Agent Trust Hub

metro-ai-app-recipe

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The install.sh script fetches AI models and sample videos from the open-edge-platform repositories on GitHub. It also pulls official Docker images from Docker Hub and GitHub Container Registry.\n- [COMMAND_EXECUTION]: The skill automates the deployment of a seven-container stack using Docker Compose and provides utility scripts (install.sh, sample_start.sh) that use curl for interacting with the pipeline server's REST API and openssl for certificate and credential generation.\n- [PRIVILEGE_ESCALATION]: Hardware acceleration (GPU/NPU) requires access to host device nodes, which is implemented via standard Docker group_add configurations for the video and render groups.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external video stream data and RTSP URLs, creating a surface for indirect injection.\n
  • Ingestion points: Input source URIs (RTSP/file/device) and class filter IDs defined in the project configuration.\n
  • Boundary markers: The validate_env.sh script provides structural validation and verification of parameters before execution.\n
  • Capability inventory: The stack includes docker-compose for orchestration, curl for REST API interaction, and gst-launch for video pipeline execution.\n
  • Sanitization: All environment variables and input parameters are strictly validated via regex and numeric range checks in validate_env.sh before deployment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 01:43 PM
Security Audit — agent-trust-hub — metro-ai-app-recipe