persona-model-trainer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data from the training directory (e.g., conversations.jsonl and raw source files) to build instruction-tuning datasets. While the documentation correctly identifies this as a security boundary and instructs the agent to ignore any embedded directives, the data is still ingested into the training pipeline, representing a classic indirect injection surface.
- [COMMAND_EXECUTION]: Orchestration scripts such as pipeline.sh, train.py, and export.py frequently utilize the subprocess module to run shell commands, install environment dependencies via pip/uv, and execute model conversion tools like llama.cpp and mlx_lm.
- [DYNAMIC_EXECUTION]: The project includes dynamic execution patterns, notably the use of eval() in its unit test suite to validate notebook generation and instructions to the agent to generate and execute wrapper scripts for hyperparameter tuning.
- [EXTERNAL_DOWNLOADS]: The pipeline automates the retrieval of external resources, including model weights from the Hugging Face Hub and specialized libraries like Unsloth directly from GitHub, which are standard for AI development workflows.
- [DYNAMIC_EXECUTION]: Several core scripts (check_env.py, eval_probe.py, voice_test.py) employ dynamic module loading via import to detect hardware-specific acceleration backends and optional dependencies at runtime.
Audit Metadata