nemo-retriever

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The references/install.md file contains instructions for system-level package installation using sudo apt-get install for dependencies such as libreoffice and ffmpeg. These tools are necessary for the skill's primary function of processing Office and multimedia files. Additionally, scripts/filename_fast_path.py uses subprocess.run to invoke the retriever binary, which is a functional requirement for localized PDF processing within the venv.\n- [EXTERNAL_DOWNLOADS]: The skill's installation workflow in references/install.md involves cloning the official NVIDIA NeMo-Retriever repository from GitHub and downloading Torch wheels from the official PyTorch registry. These sources are considered trusted and well-known for the technical requirements of the skill.\n- [PROMPT_INJECTION]: The skill processes user-provided multimodal documents (PDFs, images, etc.) and interpolates the extracted text into the agent's context, presenting an indirect prompt injection surface.\n
  • Ingestion points: The retriever ingest CLI command processes directories containing user documents (SKILL.md, references/cli/ingest.md).\n
  • Boundary markers: The instructions mandate citations and passage inspection but do not explicitly require the agent to use robust delimiters (e.g., XML tags) to isolate document text from instructions.\n
  • Capability inventory: The agent utilizes the retriever CLI for searching and a targeted text-extraction tool for retrieving page elements.\n
  • Sanitization: There is no mention of explicit sanitization or filtering logic for the content extracted from processed documents before it is added to the AI's prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 01:39 AM
Security Audit — agent-trust-hub — nemo-retriever