bailian-finetune
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
blcommand-line interface for managing the entire model fine-tuning lifecycle, including data validation, upload, training job creation, and service deployment. - [CREDENTIALS_UNSAFE]: The documentation references flags for sensitive authentication credentials, including
--api-key,--access-key-id, and--access-key-secret. These are standard authentication mechanisms for the platform's CLI, and the skill correctly notes that an API key is required for the pipeline. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes external data in the form of training datasets (
.jsonland.zipfiles) through thebl dataset uploadandbl dataset validatecommands. - Boundary markers: The instructions do not define specific prompt boundaries for the content of the datasets, but they mandate the use of
bl dataset validateas a pre-flight structural check. - Capability inventory: The skill has the capability to read local files, perform network uploads to Alibaba Cloud, and manage remote model training and deployment processes.
- Sanitization: Local validation is performed using the
bl dataset validatecommand, which checks records against specific schemas (e.g., chatml, dpo, cpt) before the data is uploaded or used for training.
Audit Metadata