persona-model-trainer

Pass

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies extensively on shell command execution via Python's subprocess module and shell scripts (scripts/pipeline.sh). It invokes external tools such as ollama, llama-cli, and optimum-cli to perform model conversion, registration, and serving tasks. \n- [EXTERNAL_DOWNLOADS]: Fetches pre-trained models and tokenizer configurations from HuggingFace repositories. These downloads target a well-known service and are necessary for the skill's primary function of model fine-tuning. \n- [PROMPT_INJECTION]: The skill ingests untrusted training data from training/raw/ and training/conversations.jsonl, creating a surface for Indirect Prompt Injection (Category 8). Evidence of mitigation is found in SKILL.md, which instructs the agent to treat this data as raw text and log warnings if embedded directives like 'ignore previous instructions' are detected. It also includes a scan_pii function in scripts/prepare_data.py to identify sensitive information in the data. \n- [REMOTE_CODE_EXECUTION]: Utilizes eval() in tests/test_scripts.py to validate string escaping within generated Jupyter notebooks. While eval() is a high-risk function, its use in this context is confined to the test suite for verifying code generation logic. \n- [SAFE]: The skill implements hardware fingerprinting in scripts/check_env.py to recommend appropriate model tiers and backends, which is consistent with the requirements for high-performance training tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 25, 2026, 03:40 PM