Scanned skills

nvidia/skills tao-finetune-huggingface-model

Checked the catalogued skill at tao-finetune-huggingface-model.

SkillTrust corpus scan 19 September 2026 v0.10.0 via skillsh Verify on GitHub
F AI-triaged 49
F Security

F; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →

F Permissions

F; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 49
permission_hygienehigh SD-003
SKILL.md
securityhigh SD-022
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
transparencymedium SD-007
examples/convnext-tiny-cifar10/config.yaml
transparencymedium SD-007
examples/convnext-tiny-cifar10/config.yaml
transparencymedium SD-007
examples/convnext-tiny-cifar10/config.yaml
securityhigh SD-011
examples/convnext-tiny-cifar10/config.yaml
transparencymedium SD-007
examples/convnext-tiny-cifar10/config.yaml
transparencymedium SD-007
examples/convnext-tiny-cifar10/config.yaml
6 suppressed by AI triage
securityhigh SD-007 benign_example
examples/convnext-tiny-cifar10/Dockerfile

The line only contains a license URL in a comment; no network call is made.

securityhigh SD-007 benign_example
examples/detr-resnet50-cppe5/Dockerfile

The line only contains a license URL in a comment; no network call is made.

securityhigh SD-007 benign_example
examples/segformer-b0-foodseg103/Dockerfile

The line only contains a license URL in a comment; no network call is made.

securityhigh SD-007 benign_example
examples/smolvlm-256m-vqav2/Dockerfile

The line only contains a license URL in a comment; no network call is made.

securitymedium SD-012 benign_example
references/cv-scripts.md

The line is a comment in a documentation template, not an executable post-install script.

permission_hygienehigh SD-003 benign_example
references/dataset-sources.md

The file is documentation; the path traversal mention is only a comment and not executable code.