peft-fine-tuning
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install several packages from the official Python Package Index (PyPI), including 'peft', 'transformers', 'bitsandbytes', and 'datasets'. It also provides code to download pre-trained models (such as Llama-3.1) and datasets (such as databricks-dolly-15k) from Hugging Face's official repositories, which are well-known and trusted services.
- [PROMPT_INJECTION]: The skill is designed to ingest and process external datasets for training purposes (e.g., using 'load_dataset'). This creates a vulnerability surface for indirect prompt injection, where malicious instructions embedded in a dataset could potentially influence the model's behavior or the agent's actions during the training pipeline. The skill uses standard instruction-response templates as boundary markers, which mitigates but does not fully eliminate this risk.
Audit Metadata