tao-run-inference-service
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill instructs the agent to prefix container commands with 'umask 0' in the inner command templates.
- Evidence: Found in SKILL.md Section 4.1 and references/code-templates.yaml for 'cosmos-rl', 'cosmos-predict2.5', and 'tao-dataservices'.
- Impact: This sets the file mode creation mask to zero, resulting in world-writable and world-readable permissions (0777 equivalent) for all files and directories created by the service, allowing unauthorized local users to access or modify service artifacts.
- [COMMAND_EXECUTION]: The skill involves extensive construction and execution of shell commands using system tools incorporating user-controlled parameters.
- Evidence: Python templates in references/code-templates.yaml use the 'subprocess' module to call system binaries including 'ssh', 'squeue', 'sacct', and 'kubectl'.
- Evidence: SKILL.md Section 4.1 describes building shell command strings for container execution that interpolate user-provided values like 'model_path' and 'host_port'.
- [DYNAMIC_EXECUTION]: The skill provides numerous Python code templates for the agent to instantiate and execute during runtime.
- Evidence: Found in references/code-templates.yaml, which contains templates for 'job_payload_builder', 'registry_write', 'readiness_check', and 'stop' flows.
- Operations: These templates perform sensitive tasks including filesystem writes to '/tmp/tao-inf-ms-state.json', spawning background processes for SSH port-forwarding, and making network requests.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided inference request bodies and model path values, presenting a vulnerability surface for indirect injection.
- Evidence: SKILL.md Section 6.2 and references/request.yaml define methods for sending multimodal messages to the microservice.
- Sanitization: Untrusted data from the user is interpolated into request bodies and command arguments with minimal sanitization beyond basic URI scheme checks for model paths.
Audit Metadata