physicalai-runtime-configuring-inference-pipeline

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill describes an inference system that instantiates components (preprocessors, postprocessors, and runners) dynamically based on class_path and init_args defined in YAML manifest files. This process is managed by a ComponentRegistry within the project's internal physicalai package and is used for modular pipeline construction.
  • [COMMAND_EXECUTION]: The validation workflow utilizes standard Python development tools, specifically uv run pytest, to execute local unit tests. These operations are restricted to the local development environment and are used to verify the integrity of the configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill acknowledges an attack surface where external manifest data could include malicious paths. It mitigates this risk by mandating a security check to ensure artifact file names in manifests do not traverse paths (e.g., using .. or absolute paths). This follows secure development practices for handling external configuration inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 04:38 PM
Security Audit — agent-trust-hub — physicalai-runtime-configuring-inference-pipeline