finetuning

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • Execution of Local Scripts: The script scripts/calibrate_grader.py utilizes the exec() and compile() functions to load and test Python grader logic from local files. This is a primary feature used for Reinforcement Fine-Tuning (RFT) to evaluate model outputs. Because this involves executing arbitrary Python code on the local machine, the script contains a specific security warning advising users to only load grader files that have been reviewed or authored by themselves.
  • System Command Integration: The utility scripts/deploy_model.py invokes the Azure CLI (az) using subprocess.run to manage resource deployments and retrieve authentication tokens. This behavior is standard and expected for tools designed to automate Microsoft Azure cloud infrastructure tasks.
  • Dynamic Code Submission: In scripts/submit_training.py, user-defined Python grader code is submitted to the Azure AI Foundry service. The platform documentation indicates that this code is executed within a constrained environment specifically for training rollouts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 06:15 AM
Security Audit — agent-trust-hub — finetuning