persona-model-trainer
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies extensively on shell command execution via Python's subprocess module and shell scripts (
scripts/pipeline.sh). It invokes external tools such asollama,llama-cli, andoptimum-clito perform model conversion, registration, and serving tasks. \n- [EXTERNAL_DOWNLOADS]: Fetches pre-trained models and tokenizer configurations from HuggingFace repositories. These downloads target a well-known service and are necessary for the skill's primary function of model fine-tuning. \n- [PROMPT_INJECTION]: The skill ingests untrusted training data fromtraining/raw/andtraining/conversations.jsonl, creating a surface for Indirect Prompt Injection (Category 8). Evidence of mitigation is found inSKILL.md, which instructs the agent to treat this data as raw text and log warnings if embedded directives like 'ignore previous instructions' are detected. It also includes ascan_piifunction inscripts/prepare_data.pyto identify sensitive information in the data. \n- [REMOTE_CODE_EXECUTION]: Utilizeseval()intests/test_scripts.pyto validate string escaping within generated Jupyter notebooks. Whileeval()is a high-risk function, its use in this context is confined to the test suite for verifying code generation logic. \n- [SAFE]: The skill implements hardware fingerprinting inscripts/check_env.pyto recommend appropriate model tiers and backends, which is consistent with the requirements for high-performance training tasks.
Audit Metadata