ml-pipeline
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for shell scripts to launch distributed training using
torchrun. It also utilizes standard Python library functions for file system management, such asshutilandpathlib, which are necessary for managing ML artifacts. - [DATA_EXFILTRATION]: The skill is designed to manage machine learning data flows, which includes uploading trained models to cloud storage providers (Amazon S3 and Google Cloud Storage) and sending performance metrics to experiment tracking platforms like MLflow and Weights & Biases. These network operations are aligned with the skill's stated purpose.
- [REMOTE_CODE_EXECUTION]: The code templates for saving and loading models utilize
pickleandjoblib. These serialization formats are known to be vulnerable to unsafe deserialization if used with untrusted input. However, in the context of an ML orchestration skill, this is standard practice, and the skill includes recommendations for data validation to mitigate associated risks. - [EXTERNAL_DOWNLOADS]: The skill's orchestration templates (e.g., Kubeflow components) specify necessary Python packages like
pandas,scikit-learn, andmlflowfor installation in containerized environments. These downloads target official registries and well-known services and do not involve untrusted remote scripts. - [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill maintains a clear focus on infrastructure and automation for data science workflows.
Audit Metadata