Scanned skills

nvidia/skills rag-perf

Checked the catalogued skill at rag-perf.

SkillTrust corpus scan 7 November 2026 v0.13.0 via skillsh Verify on GitHub
D AI-triaged 19
D Security

D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 19
permission_hygienehigh SD-003
SKILL.md
securityhigh SD-007
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
transparencymedium SD-007
eval/h100.json
transparencymedium SD-007
eval/nvidia_hosted.json
transparencymedium SD-007
eval/nvidia_hosted.json
7 suppressed by AI triage
securityhigh SD-007 benign_example
SKILL.md

The file is documentation and the outbound call is an example, not executable code.

permission_hygienehigh SD-003 benign_example
SKILL.md

No actual path traversal strings are present in the file content, indicating a false positive.

permission_hygienehigh SD-003 benign_example
SKILL.md

The excerpt shows no concrete path traversal, only a generic redaction indicator.

permission_hygienehigh SD-003 benign_example
SKILL.md

No path traversal evidence in the context; the line contains only empty content.

permission_hygienehigh SD-003 benign_example
SKILL.md

No path traversal evidence in the context; the line contains only empty content.

securityhigh SD-007 benign_example
eval/h100.json

Documentation describes outbound calls; no actual code present.

securityhigh SD-007 benign_example
eval/h100.json

The content is documentation describing a detection, not an actual outbound network call or permission grant.