deepstream-import-vision-model

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a legitimate technical workflow for DeepStream model integration. All downloads target well-known and trusted platforms (Hugging Face, NVIDIA NGC).
  • [COMMAND_EXECUTION]: The skill uses shell scripts and Python to orchestrate the pipeline. Static analysis flagged subprocess.run calls in md-to-html-pdf.py and render-mermaid-for-pdf.py; however, these are used safely with shell=False to execute standard utilities like wkhtmltopdf and mmdc using validated parameters.
  • [DATA_EXPOSURE]: The skill includes security-conscious measures such as md-to-html-pdf.py rejecting path traversal when embedding images and intentionally disabling local file access for the PDF generator to block potential exfiltration vectors from untrusted markdown content.
  • [PROMPT_INJECTION]: Instructions encouraging autonomous execution ("Run the full pipeline autonomously without pausing for confirmation") are operational for this workflow and do not attempt to bypass safety filters or ignore prior instructions.
  • [EXTERNAL_DOWNLOADS]: The skill fetches standard machine learning packages (e.g., optimum, transformers, torch) and system tools (wkhtmltopdf, mediainfo). These are well-known dependencies required for the stated purpose of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 04:52 PM
Security Audit — agent-trust-hub — deepstream-import-vision-model