finetuning
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Execution of Local Scripts: The script
scripts/calibrate_grader.pyutilizes theexec()andcompile()functions to load and test Python grader logic from local files. This is a primary feature used for Reinforcement Fine-Tuning (RFT) to evaluate model outputs. Because this involves executing arbitrary Python code on the local machine, the script contains a specific security warning advising users to only load grader files that have been reviewed or authored by themselves. - System Command Integration: The utility
scripts/deploy_model.pyinvokes the Azure CLI (az) usingsubprocess.runto manage resource deployments and retrieve authentication tokens. This behavior is standard and expected for tools designed to automate Microsoft Azure cloud infrastructure tasks. - Dynamic Code Submission: In
scripts/submit_training.py, user-defined Python grader code is submitted to the Azure AI Foundry service. The platform documentation indicates that this code is executed within a constrained environment specifically for training rollouts.
Audit Metadata