skills/microsoft/skills/finetuning/Gen Agent Trust Hub

finetuning

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • Dynamic Code Execution: The calibrate_grader.py script utilizes the exec() function to load custom grading logic from a local file. This allows for flexible evaluation but means that any code in the provided grader file will be executed with the script's permissions. The code includes a warning to only use reviewed grader files.
  • Command Invocations: The deploy_model.py script calls the Azure CLI (az) via subprocess.run() to obtain authentication tokens. This is a common pattern for automating Azure deployments but relies on the local installation and configuration of the Azure CLI.
  • Data Ingestion Risks: The skill processes training datasets in JSONL format through several scripts. Since these datasets may contain untrusted content, there is a potential surface for indirect prompt injection if the agent processes malicious instructions embedded in the data.
  • Administrative Capability: The skill contains scripts for resource lifecycle management, such as deleting deployments and files (cleanup.py). These functions are necessary for the skill's purpose but should be used with caution to avoid unintended resource deletion.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 04:28 PM
Security Audit — agent-trust-hub — finetuning