microsoft-foundry

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Dynamic Execution in Fine-Tuning Scripts: The script finetuning/scripts/calibrate_grader.py uses exec() and compile() to load and evaluate local Python grader files.
  • This pattern is used to support Reinforcement Fine-Tuning (RFT) workflows where custom logic is required to score model outputs.
  • The script includes clear security documentation advising users to only load trusted code, as it runs with the same permissions as the execution context.
  • Local Command Execution via Subprocess: Several scripts, such as finetuning/scripts/deploy_model.py and environment verification scripts, use subprocess.run() to interact with the Azure CLI (az).
  • This is used for legitimate purposes like retrieving Entra ID access tokens and verifying the local developer environment setup.
  • External Resource Downloads: The skill references and downloads infrastructure-as-code templates and samples from official Microsoft GitHub repositories (Azure-Samples/azd-ai-starter-basic and microsoft-foundry/foundry-samples).
  • These downloads are used to scaffold projects and provision resources through the Azure Developer CLI (azd) and originate from trusted vendor sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 12:21 AM
Security Audit — agent-trust-hub — microsoft-foundry