tao-run-deft-cr-its-mining

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The workflow utilizes Bash and the subprocess module to manage the machine learning pipeline. The script scripts/restore_docker_mount_permissions.py executes Docker commands to adjust file ownership and permissions for output directories created by containers.\n- [EXTERNAL_DOWNLOADS]: The skill fetches machine learning models from Hugging Face using the huggingface_hub library. This is used to retrieve pre-trained checkpoints (e.g., nvidia/Cosmos-Embed1-224p) for the workflow's embedding stage.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided datasets that serve as a surface for indirect prompt injection.\n
  • Ingestion points: Processes LLaVA-formatted annotations from kpi_dataset.annotations_path and train_dataset.annotations_path in scripts/prepare_cosmos_embed_inference.py and scripts/prepare_cosmos_reason_train.py.\n
  • Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when processing the conversational content in these datasets.\n
  • Capability inventory: The workflow includes capabilities for shell command execution via Docker, extensive file system access, and coordination of multiple specialized ML tools.\n
  • Sanitization: The conversational turns (human and assistant responses) in the LLaVA annotations are used without sanitization or filtering to generate training and evaluation configurations.\n- [PRIVILEGE_ESCALATION]: The workflow performs recursive chown and chmod operations on the host filesystem using Docker. The restore_docker_mount_permissions.py script runs a privileged container to modify host directory permissions, resolving access issues for files created by containerized processes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:56 AM
Security Audit — agent-trust-hub — tao-run-deft-cr-its-mining