tao-train-metric-learning-recognition
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as datasets and model checkpoints, which represents an attack surface for indirect prompt injection if the data source is untrusted. * Ingestion points: Dataset paths in SKILL.md and checkpoint paths in references/skill_info.yaml. * Boundary markers: No explicit prompt boundary markers are provided in the instructions. * Capability inventory: The skill uses the Bash tool to execute ml_recog commands inside Docker containers. * Sanitization: No sanitization logic for input paths or metadata is described in the instructions.
- [DYNAMIC_EXECUTION]: The skill mentions enabling TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1, which allows unsafe deserialization of PyTorch checkpoints using pickle. This is a known security risk in the PyTorch ecosystem. * Evidence: SKILL.md contains instructions to use this environment variable for loading checkpoints produced by the same trusted workflow while explicitly warning against its use for untrusted checkpoints.
Audit Metadata