fine-tuning-serving-openpi

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly requires cloning a public GitHub repo, setting dataset repo_id (potentially arbitrary public/user datasets such as LeRobot/HuggingFace), and downloading/using public checkpoints (e.g., gs://openpi-assets) as part of required training/serving workflows, which means the agent will ingest and act on untrusted third‑party content that can materially change model behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs cloning and installing remote code (git clone https://github.com/Physical-Intelligence/openpi.git and pip installing the client via git+https://github.com/Physical-Intelligence/openpi.git#subdirectory=packages/openpi-client), which fetches repository code at runtime and causes execution of that remote code on the host.