learn-cute-dsl

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions prompt the agent to execute shell commands to query GPU hardware information using nvidia-smi and to run kernel profiling and testing suites via python -m. These are standard diagnostic and benchmarking tools used in GPU development workflows.- [DYNAMIC_EXECUTION]: The workflow requires the agent to generate new Python scripts (e.g., KernelPlan subclasses and __main__.py entry points) that wrap external library code for execution. This script generation is a core part of the skill's purpose to facilitate the import and execution of library examples.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface as it reads and executes code from the third_party/cutlass/ directory. An attacker with the ability to modify these local files could influence the agent's behavior during the READ and IMPORT phases.
  • Ingestion points: The skill reads Python and DSL source files from third_party/cutlass/examples/python/CuTeDSL/.
  • Boundary markers: None present in the instructions to distinguish between trusted code and embedded instructions.
  • Capability inventory: The agent generates and executes code based on these inputs using the python interpreter.
  • Sanitization: No explicit sanitization or validation of the source code content is performed before analysis or execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 08:49 AM