skills/terminalskills/skills/gradio/Gen Agent Trust Hub

gradio

Pass

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of reputable Python packages from public registries, including gradio, openai, transformers, torch, and pandas. It also fetches pre-trained models from Hugging Face and Google, which are well-known and trusted services.
  • [COMMAND_EXECUTION]: Includes standard CLI instructions for environment setup using pip and repository management with git and huggingface-cli. These commands represent typical developer workflows for machine learning deployment.
  • [PROMPT_INJECTION]: The skill implements chat interfaces and file-processing functions (CSV, images) that ingest untrusted external data. While this presents an indirect prompt injection surface, it is a core feature of the library and is presented here for educational purposes.
  • [DATA_EXFILTRATION]: Demonstrates the use of the share=True parameter to create temporary public URLs for demonstrations. This is an intended feature of the Gradio framework for collaboration and does not constitute unauthorized exfiltration.
  • [CREDENTIALS_UNSAFE]: Uses dummy values ("admin", "password123") as placeholders to illustrate how to implement authentication on the web interface, which is common in technical documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 13, 2026, 09:15 PM