axolotl
Warn
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The framework exposes several interfaces for executing system commands, notably
cli.cloud.modal_.run_cmdfor running shell commands in cloud environments andcli.utils.train.launch_trainingfor executing training processes. - [EXTERNAL_DOWNLOADS]: The skill documents tools for fetching remote resources, such as
cli.utils.fetch.fetch_from_githubfor syncing files from GitHub andcli.config.check_remote_configwhich retrieves, parses, and writes configuration files from arbitrary HTTPS URLs to the local system. - [CREDENTIALS_UNSAFE]: The function
cli.checks.check_user_tokenis designed to access and verify Hugging Face authentication tokens from the environment or configuration files to facilitate operations on the Hugging Face Hub. - [REMOTE_CODE_EXECUTION]: Installation instructions include patterns for executing remote shell scripts, such as the
uvpackage manager installer fetched fromastral.shand piped directly to the shell. - [DATA_EXFILTRATION]: The skill documents the
push_to_hubcapability, which automates the process of sending model weights, metrics, and training configurations to external Hugging Face repositories.
Audit Metadata