The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the user to run Docker containers with the --cap-add=SYS_ADMIN flag in SKILL.md. This capability provides broad administrative control over the host kernel and is frequently used as a prerequisite for container escape attacks.
[PRIVILEGE_ESCALATION]: Workflow instructions in SKILL.md specify the use of sudo pip uninstall, requiring the execution of package management operations with elevated root privileges.
[DYNAMIC_EXECUTION]: Documentation in references/custom-rewards.md provides a code generation reward function example (reward_func_code_gen.py) that uses subprocess.run to execute Python code produced by a language model. This pattern enables the execution of untrusted code generated at runtime during the training process.
[DYNAMIC_EXECUTION]: The framework allows for the dynamic loading and execution of user-defined Python scripts through parameters such as --remote_rm_url and --agent_func_path, as described in references/custom-rewards.md.
[INDIRECT_PROMPT_INJECTION]: The custom reward function architecture in references/custom-rewards.md contains a significant indirect prompt injection vulnerability. 1. Ingestion points: The queries parameter receives untrusted model-generated content. 2. Boundary markers: No delimiters or boundary instructions are used to separate model output from the execution logic. 3. Capability inventory: The implementation uses subprocess and file system access to execute generated content. 4. Sanitization: No validation, filtering, or sanitization is performed on the generated code before it is written to disk and executed.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run and CLI tool invocations to manage training jobs, process data, and evaluate model performance across multiple documentation files.
[EXTERNAL_DOWNLOADS]: The skill fetches and installs numerous Python dependencies from public repositories and pulls base images from the NVIDIA Container Registry (nvcr.io).

openrlhf-training