NVIDIA AI Blueprint for Video Search and Summarization (VSS) is a reference architecture for applications that use AI to search, analyze, question, and summarize live or recorded video. It is intended for building video analytics agents with vision-language models, language models, retrieval-augmented generation, and NVIDIA NIM microservices. The catalogue entries provide coding-agent rules, skills, commands, agents, instructions, and settings associated with the project.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/NVIDIA-AI-Blueprints/video-search-and-summarizationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/nvidia-ai-blueprints/video-search-and-summarization/security-review)<a href="https://agentmods.dev/commands/nvidia-ai-blueprints/video-search-and-summarization/security-review"><img src="https://agentmods.dev/badge/commands/nvidia-ai-blueprints/video-search-and-summarization/security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/nvidia-ai-blueprints/video-search-and-summarization/security-review"><img src="https://agentmods.dev/badge/commands/nvidia-ai-blueprints/video-search-and-summarization/security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.00684 |
| Opus 5.5 | $0.00009 | $0.00274 |
| Sonnet 5.5 | $0.00004 | $0.00137 |
| Haiku 4.5 | $0.00002 | $0.00068 |
Grade A, and why
security-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
SPDX-License-Identifier: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Review the recently changed or staged code for security issues that could trigger Checkmarx or nspect findings.
Steps:
- Run
git diff HEAD(orgit diff --cachedif changes are staged) to get the changeset. - Analyze every changed file for the following categories:
Hardcoded secrets
- Credentials, API keys, tokens, passwords in source or config files
- Check
.nspect-allowlist.tomlif adding new third-party binaries or dependencies
Unsafe C string operations
strcpy,strcat,sprintf,gets,scanfwithout bounds — flag and suggeststd::string,snprintf, or bounded alternatives
Format string issues
- Unvalidated or user-controlled format strings passed to
printf-family functions
Buffer and memory safety
- Unchecked array/pointer indexing — suggest
.at(),std::array, orstd::span - Raw
new/delete— suggest RAII / smart pointers - Integer overflow and signed/unsigned mismatch in size or index arithmetic — flag expressions like
size_tcompared againstint, or arithmetic that could wrap before a bounds check
Command injection
system(),popen(),exec*()calls with user-derived input
Path traversal
- File paths constructed from user input without sanitization
Input validation
- Any data entering via REST API that bypasses
SchemaValidator - Missing null/bounds checks on external data before use
- If a new REST endpoint lacks schema validation, show how to wire it in: register the schema JSON under
src/framework/web/schemas/and callSchemaValidator::validate()at the handler entry point
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 75 lines · 22 tokens per session scan A ca689c5bcb78
security-review is a command published in the GitHub repository NVIDIA-AI-Blueprints/video-search-and-summarization (1,947 stars, last pushed yesterday), licensed Apache-2.0. It adds 22 tokens to every session and 684 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
generate-embeddings
Generate vector embeddings for text data using embedding models.
search-similar
Find semantically similar items using vector similarity search.
doctor
Diagnose the bubbaloop install end-to-end — token, daemon, MCP transport, Zenoh router, mode, registered nodes — and tell the user the precise fix for any red status.
node-validate
Validate a node's manifest, directory structure, and command schema against the bubbaloop contract.
stream
Get the Zenoh topic and connection params for a node's data stream.
node-new
Scaffold a new bubbaloop node via the bubbaloop-node-author subagent — guided through manifest, command queryable, validation, and registration.