The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill launches Docker containers using the --privileged flag and mounts numerous sensitive host directories, including /home, /usr/local/bin, and various NPU driver paths. This configuration effectively grants the container near-complete access to the host system hardware and user data.
[COMMAND_EXECUTION]: The skill contains logic to perform mass process termination (pkill -9 python) and forceful service stops (ray stop --force). While these are common for cleaning up failed distributed training runs, they represent broad system control capabilities.
[INDIRECT_PROMPT_INJECTION]: The scripts/generate_training.sh script performs unsafe interpolation of user-provided strings (such as model paths, dataset paths, and SwanLab configurations) into shell scripts using sed with a fixed delimiter (|). A malicious input containing the delimiter character or shell command sequences could lead to arbitrary command execution when the generated start_verl.sh or run_training.sh is executed inside the container.
Ingestion points: User input collected via AskUserQuestion for model paths, URLs, and API keys is passed to generate_training.sh.
Boundary markers: None identified in the script generation templates to distinguish data from instructions.
Capability inventory: The skill executes shell scripts, runs Docker commands, and performs network operations.
Sanitization: There is no evidence of escaping or validating the user-provided variables before they are used in sed substitution commands.
[EXTERNAL_DOWNLOADS]: The skill downloads external resources, including Docker images from quay.io/ascend (a vendor-associated registry) and the swanlab Python package from standard registries. While these sources are associated with the vendor 'ascend' or well-known services, they constitute a remote code acquisition vector.
[CREDENTIALS_UNSAFE]: The skill prompts users for a SWANLAB_API_KEY and handles it by piping it into commands (e.g., echo '$SWANLAB_API_KEY' | swanlab login). This pattern can lead to sensitive credentials being recorded in shell history or process listings within the container environment.

verl-deploy