torchtitan
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install dependencies and source code from official PyTorch GitHub repositories (github.com/pytorch/torchtitan and github.com/pytorch/ao.git) and the standard PyPI registry. These are well-known and trusted sources in the machine learning ecosystem.
- [COMMAND_EXECUTION]: Instructions include standard shell commands for managing Python environments, cloning repositories, and launching distributed training via
torchrunandsrun. These operations are consistent with the skill's primary purpose of model pretraining. - [CREDENTIALS_UNSAFE]: The documentation references the use of HuggingFace tokens for asset downloads but correctly uses placeholders (e.g.,
YOUR_HF_TOKEN) and directs users to their official settings page, avoiding the exposure of actual secrets. - [DATA_EXPOSURE]: The skill facilitates the download of datasets (e.g., C4) and model weights from HuggingFace, which is standard procedure for LLM training and does not involve unauthorized exfiltration of sensitive local data.
- [SAFE]: No signs of prompt injection, code obfuscation, persistence mechanisms, or privilege escalation were found across the skill files.
Audit Metadata