model-merging
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install the mergekit library from Arcee AI's official GitHub repository and the FastChat framework from the LM-Sys repository. Both sources are well-known and reputable organizations within the machine learning community.
- [COMMAND_EXECUTION]: Instructions involve running command-line tools like mergekit-yaml and Python scripts for model quantization and evaluation. These are standard operations for the intended task of model merging.
- [INDIRECT_PROMPT_INJECTION]: The skill describes processes that ingest external model identifiers and configuration files (ingestion points). While these are untrusted data entry points, they are essential to the functionality. Capability inventory includes shell command execution and network access for model management. Boundary markers and explicit sanitization are not present in the instructional snippets, which is typical for technical developer-focused documentation.
Audit Metadata