nvrx-attr
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The SLURM job scripts (
l4_gb200_reduced.shandn3_super_gb200_fi.sh) support aCONTAINER_CLEANUP_CMDenvironment variable. If set, its content is executed as a shell command on all allocated nodes viasrunto perform post-job cleanup. - [COMMAND_EXECUTION]: The orchestration layer utilizes
srunwithbash -cblocks to perform setup tasks, including cloning Git repositories from local paths (e.g.,/megatron-lm_repo) and synchronizing source code into shared temporary directories. - [DATA_EXFILTRATION]: The analysis and scoring scripts (
watch_and_analyze.shandscore_attribution.py) access sensitive API keys for LLM providers and transmit snippets of system logs and failure analyses to remote inference endpoints (e.g., NVIDIA's inference API) to perform automated failure attribution. - [PROMPT_INJECTION]: The system is susceptible to indirect prompt injection during the scoring phase. The
score_attribution.pyscript ingests raw output from SLURM job logs and interpolates it into a prompt for an LLM judge. While basic line filtering is implemented to hide the ground-truth fault from the judge, malicious workload output could potentially influence the LLM's assessment. - Ingestion points: Log file content read in
scripts/score_attribution.pyvia theload_log_excerptfunction. - Boundary markers: The LLM prompt uses markdown headers (e.g.,
## Raw job log) to delimit external data. - Capability inventory: The skill can execute shell commands, perform file system operations on NFS/Lustre, and interact with SLURM's job scheduler (
sbatch,srun,scontrol). - Sanitization: Log lines containing specific internal package markers are removed, but the text is not escaped to prevent instruction override.
Audit Metadata