tao-run-on-virtualenv
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.Popenandsubprocess.callwithinreferences/virtualenv_runner.pyto execute user-provided Python scripts and the Python interpreter associated with a virtual environment. It also executes standard system utilities likepsandpgrepfor process monitoring on Linux and macOS hosts. - [DYNAMIC_EXECUTION]: The runner utility generates a local wrapper script,
launch_job.py, which is written to the job's results directory. This script acts as a gatekeeper to manage the process lifecycle, ensuring the training script is executed in a new session and that all child processes are cleaned up upon completion. - [SAFE]: The implementation includes several security best practices for local process execution:
- Symlink Protection: Uses
os.O_EXCLandos.O_NOFOLLOWwhen creating the job wrapper and metadata files to prevent symlink-based file clobbering or unauthorized execution of pre-planted files. - Process Identity Verification: Employs an opaque process start marker (retrieved from
/proc/[pid]/statorps lstart) to ensure thatstatusandcanceloperations only target the exact process intended, preventing actions against recycled PIDs. - Group Cleanup: Automatically terminates the entire process group upon script completion to prevent resource leaks from background workers like data loaders.
Audit Metadata