nvidia/skills jetson-llm-benchmark
Checked the catalogued skill at jetson-llm-benchmark.
F; retained sample includes a critical finding · SD-009 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
A set by no findings on this axis
6 suppressed by AI triage
The text only mentions that an outbound curl call was not performed, so no real network activity occurs.
Similarly, the content states that no outbound curl request was made, indicating no actual network call.
The '..' traversal is a static, hard‑coded relative path within the script, not driven by user input, and does not expose arbitrary file access.
The path traversal is used only to compute a relative directory path within the script and does not expose or write to arbitrary system directories.
The endpoint defaults to a localhost address; no outbound network request is made by the script itself.
The endpoint assignment is a configuration value pointing to localhost, not an actual network call.