huggingface-accelerate
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing standard machine learning libraries via
pipand cloning research repositories from NVIDIA's official GitHub organization (e.g., Megatron-LM and apex). These are well-known resources in the machine learning development ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill operates on user-provided training scripts and datasets, which represents a potential attack surface if an attacker controls the input data. However, this behavior is inherent to the purpose of a developer tool for model training.
- Ingestion points: Reads local training scripts (
train.py), configuration files (deepspeed_config.json), and datasets. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Executes shell commands for package installation and model launching (
accelerate launch). - Sanitization: Standard developer tool behavior without specific input sanitization for scripts.
Audit Metadata