tao-run-deft-cr-its-mining
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow utilizes
Bashand thesubprocessmodule to manage the machine learning pipeline. The scriptscripts/restore_docker_mount_permissions.pyexecutes Docker commands to adjust file ownership and permissions for output directories created by containers.\n- [EXTERNAL_DOWNLOADS]: The skill fetches machine learning models from Hugging Face using thehuggingface_hublibrary. This is used to retrieve pre-trained checkpoints (e.g.,nvidia/Cosmos-Embed1-224p) for the workflow's embedding stage.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided datasets that serve as a surface for indirect prompt injection.\n - Ingestion points: Processes LLaVA-formatted annotations from
kpi_dataset.annotations_pathandtrain_dataset.annotations_pathinscripts/prepare_cosmos_embed_inference.pyandscripts/prepare_cosmos_reason_train.py.\n - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when processing the conversational content in these datasets.\n
- Capability inventory: The workflow includes capabilities for shell command execution via Docker, extensive file system access, and coordination of multiple specialized ML tools.\n
- Sanitization: The conversational turns (human and assistant responses) in the LLaVA annotations are used without sanitization or filtering to generate training and evaluation configurations.\n- [PRIVILEGE_ESCALATION]: The workflow performs recursive
chownandchmodoperations on the host filesystem using Docker. Therestore_docker_mount_permissions.pyscript runs a privileged container to modify host directory permissions, resolving access issues for files created by containerized processes.
Audit Metadata