cuda-auto-tune
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The scripts/ncu_profile.sh script executes shell commands and binaries provided by the user (the kernels being optimized) as part of the profiling process. This is the intended behavior for performance measurement tools.
- [COMMAND_EXECUTION]: The scripts/ncu_analyse.py script invokes the NVIDIA Nsight Compute (ncu) command-line tool safely using the subprocess module to process report files.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external profiling data (such as kernel names and hardware metrics) and presents it in a summary report. This creates a surface for indirect prompt injection if malicious data were embedded in the kernel metrics. (1) Ingestion points: NCU CSV metrics are read in scripts/ncu_analyse.py. (2) Boundary markers: None present in the generated analysis report. (3) Capability inventory: Subprocess execution for profiling and data conversion; file system access for reading/writing reports. (4) Sanitization: None applied to kernel names or labels before display in the report.
Audit Metadata