verl-async-dapo

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell scripts to manage the lifecycle of machine learning training jobs.
  • It uses docker exec to launch training commands inside isolated containers.
  • It implements cleanup logic using ray stop --force and pkill -9 ray to ensure distributed training sessions do not have stale processes interfering with new runs.
  • It performs hardware verification using npu-smi to detect Ascend NPU types (910B/A3), ensuring the correct environment is present.
  • [EXTERNAL_DOWNLOADS]: The workflow documentation references official Docker images hosted on quay.io/ascend. These are vendor-owned resources from the author (ascend) necessary for the skill's operation.
  • [CREDENTIALS_SAFE]: The skill manages SWANLAB_API_KEY for integration with the SwanLab experiment tracking platform. Keys are handled via environment variables or interactive user prompts, which is standard practice for telemetry in AI development. No hardcoded secrets were detected.
  • [DYNAMIC_EXECUTION]: The config_generator.py script generates Hydra configuration files and shell scripts based on user-provided parameters. This is a legitimate use case for dynamic script generation to handle complex command-line arguments for distributed training frameworks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 01:44 PM