tao-run-automl
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates workflows by generating and executing shell scripts (e.g.,
run_baseline.sh) and Python drivers (e.g.,driver.py) usingbashandpythonin detached modes withnohupto manage long-running training sessions. - [DYNAMIC_EXECUTION]: The skill uses
importlibfor module loading within its test suite and generates executable Python code at runtime via heredocs to interface with theAutoMLRunnerlibrary. - [EXTERNAL_DOWNLOADS]: The skill fetches model weights (backbones) and datasets from external sources, including Hugging Face and NVIDIA-managed S3 buckets (
nvcf-storage-handling), which are standard for machine learning workflows. - [INDIRECT_PROMPT_INJECTION]: The "autoresearch" and LLM-guided algorithms ingest experiment history and external model schemas to generate tuning recommendations, which constitutes a potential surface for indirect prompt injection if those inputs were to be untrusted; however, the skill emphasizes using packaged, validated schemas.
- [SAFE]: All identified external resources and organizations (NVIDIA, Hugging Face, Weights & Biases) are well-known, trusted entities within the AI development ecosystem, and the skill's operations align with its primary purpose.
Audit Metadata