The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted dataset files to train models. A malicious dataset could influence model behavior or exploit the data loading process.
Ingestion points: Multiple scripts (assets/sft_train.py, assets/dpo_train.py, assets/reward_train.py, assets/dataset_prep.py) ingest user-provided JSON/JSONL dataset files. Specifically, assets/sft_train.py extracts local file paths for audio and image data directly from these datasets.
Boundary markers: The skill relies on standard model chat templates (e.g., <|turn>user, <|turn>model) to structure message content, but these do not prevent adversarial content within the messages from affecting the training process.
Capability inventory: assets/sft_train.py reads local filesystem data using librosa.load and image processors based on paths supplied in the untrusted dataset. assets/distill_dataset.py performs network requests to a local Ollama API endpoint.
Sanitization: There is no validation or sanitization of file paths provided in the dataset messages before they are used in file-read operations.

gemma-trainer