The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the official PufferLib source code on GitHub and its published packages on PyPI. These references include specific, immutable commit hashes and SHA-256 digests for provenance verification, following best practices for software supply chain security.
[CREDENTIALS_UNSAFE]: The skill includes a dedicated secret_key_paths function that scans configuration data for sensitive keys such as api_key, token, and secret. The validation logic proactively rejects plans or metadata containing potential credentials to prevent accidental exposure.
[DATA_EXFILTRATION]: Filesystem access is strictly controlled through a resolve_local_path helper that prevents directory traversal and symlink-following. This ensures that file operations are confined to authorized project directories and prevents access to sensitive system files.
[REMOTE_CODE_EXECUTION]: The inspect_checkpoint.py utility provides a secure method for analyzing model files. It calculates cryptographic hashes and inspects file headers for format detection while explicitly avoiding the use of torch.load or pickle.load, which effectively mitigates the risk of executing malicious code embedded in untrusted model checkpoints.
[DYNAMIC_EXECUTION]: The training template generator (train_template.py) is designed for safety; it builds command-line argument previews for human review and explicitly avoids executing the generated commands, maintaining human-in-the-loop oversight for all training operations.

pufferlib