Security Audit

NVIDIA/cuopt:skills/cuopt-server-api-python

github.com/NVIDIA/cuopt

AI SkillCommit 088dfec1c885

CRITICAL

Scanned 5 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

NVIDIA/cuopt:skills/cuopt-server-api-python received a trust score of 35/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 6 findings: 1 critical, 0 high, 5 medium, and 0 low severity. Key findings include Suspicious import: requests, Remote code execution: curl/wget pipe to shell.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 35/100, indicating areas for improvement.

Last analyzed on July 17, 2026 (commit 088dfec1). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

35%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Network Access

6 findings

Shell Execution

1 finding

Excessive Permissions

5 findings

Security Findings6

Severity	Finding	Layer	Location
CRITICAL	Remote code execution: curl/wget pipe to shell Detected a pattern that downloads and immediately executes remote code. This is a primary malware delivery vector. Never pipe curl/wget output directly to a shell interpreter.	Static	skills/cuopt-server-api-python/SKILL.md:39
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/cuopt-server-api-python/assets/lp_basic/client.py:15
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/cuopt-server-api-python/assets/milp_basic/client.py:13
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/cuopt-server-api-python/assets/pdp_basic/client.py:10
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/cuopt-server-api-python/assets/vrp_basic/client.py:15
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Static	skills/cuopt-server-api-python/assets/vrp_simple/client.py:13

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/023a40dc9da2dd58.svg)](https://skillshield.io/report/023a40dc9da2dd58)