get-available-resources
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/detect_resources.pyexecutes system hardware detection utilities includingnvidia-smi,rocm-smi,sysctl, andsystem_profilerviasubprocess.run. These calls use hardcoded argument lists without shell interpolation, mitigating command injection risks. - [DYNAMIC_EXECUTION]: The detection script uses
__import__("datetime")to dynamically load the standard Python datetime module for timestamping the resource report. This is a low-risk use of dynamic loading targeting a known safe standard library module. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface by ingesting untrusted hardware data from system command outputs (Ingestion points:
nvidia-smi,system_profilerinscripts/detect_resources.py). It lacks explicit boundary markers or sanitization for potential LLM injection in the generated JSON report (Sanitization: Absent). The skill possesses capabilities to write files and execute subprocesses (Capability inventory:subprocess.run,json.dumpinscripts/detect_resources.py).
Audit Metadata