microsoft-foundry
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Dynamic Execution in Fine-Tuning Scripts: The script
finetuning/scripts/calibrate_grader.pyusesexec()andcompile()to load and evaluate local Python grader files. - This pattern is used to support Reinforcement Fine-Tuning (RFT) workflows where custom logic is required to score model outputs.
- The script includes clear security documentation advising users to only load trusted code, as it runs with the same permissions as the execution context.
- Local Command Execution via Subprocess: Several scripts, such as
finetuning/scripts/deploy_model.pyand environment verification scripts, usesubprocess.run()to interact with the Azure CLI (az). - This is used for legitimate purposes like retrieving Entra ID access tokens and verifying the local developer environment setup.
- External Resource Downloads: The skill references and downloads infrastructure-as-code templates and samples from official Microsoft GitHub repositories (
Azure-Samples/azd-ai-starter-basicandmicrosoft-foundry/foundry-samples). - These downloads are used to scaffold projects and provision resources through the Azure Developer CLI (
azd) and originate from trusted vendor sources.
Audit Metadata