tao-run-on-virtualenv

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.Popen and subprocess.call within references/virtualenv_runner.py to execute user-provided Python scripts and the Python interpreter associated with a virtual environment. It also executes standard system utilities like ps and pgrep for process monitoring on Linux and macOS hosts.
  • [DYNAMIC_EXECUTION]: The runner utility generates a local wrapper script, launch_job.py, which is written to the job's results directory. This script acts as a gatekeeper to manage the process lifecycle, ensuring the training script is executed in a new session and that all child processes are cleaned up upon completion.
  • [SAFE]: The implementation includes several security best practices for local process execution:
  • Symlink Protection: Uses os.O_EXCL and os.O_NOFOLLOW when creating the job wrapper and metadata files to prevent symlink-based file clobbering or unauthorized execution of pre-planted files.
  • Process Identity Verification: Employs an opaque process start marker (retrieved from /proc/[pid]/stat or ps lstart) to ensure that status and cancel operations only target the exact process intended, preventing actions against recycled PIDs.
  • Group Cleanup: Automatically terminates the entire process group upon script completion to prevent resource leaks from background workers like data loaders.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 02:56 AM
Security Audit — agent-trust-hub — tao-run-on-virtualenv