nvidia/skills nv-segment-ct
Checked the catalogued skill at nv-segment-ct.
D; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
18 suppressed by AI triage
The script references a public license URL which is benign.
The script downloads a public dataset from a trusted source, not malicious.
Same as id=2, benign download of a public dataset.
The urllib.request call is for a legitimate data fixture download.
Reference to a public dataset mirror URL is benign.
The urllib.request.urlopen call is used to fetch a legitimate public dataset.
Commented URL to a license, not an executed outbound network call or permission grant.
The URL appears only in a comment and does not trigger any outbound network call.
The HuggingFace link is only a comment reference and not executed as code.
The model repository URL is included in a string literal within a data structure, not as an executable network call.
Declares a legitimate external endpoint for the skill; no malicious code or suspicious activity.
Specifies the GitHub repository for required resources; a normal, legitimate declaration.
Points to a Hugging Face model repository; expected for the skill's operation.
Lists Hugging Face as a network endpoint; a standard, required source for models.
Includes raw.githubusercontent.com as an endpoint for source code retrieval; normal for the skill.
Mentions the S3 bucket for model weights; legitimate external resource for the skill.
The URL appears only in a comment header, not as executable outbound network code.
The $schema field is a declarative reference to a public JSON schema, not an executed outbound network call or permission grant.