nvrx-attr

Pass

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The SLURM job scripts (l4_gb200_reduced.sh and n3_super_gb200_fi.sh) support a CONTAINER_CLEANUP_CMD environment variable. If set, its content is executed as a shell command on all allocated nodes via srun to perform post-job cleanup.
  • [COMMAND_EXECUTION]: The orchestration layer utilizes srun with bash -c blocks to perform setup tasks, including cloning Git repositories from local paths (e.g., /megatron-lm_repo) and synchronizing source code into shared temporary directories.
  • [DATA_EXFILTRATION]: The analysis and scoring scripts (watch_and_analyze.sh and score_attribution.py) access sensitive API keys for LLM providers and transmit snippets of system logs and failure analyses to remote inference endpoints (e.g., NVIDIA's inference API) to perform automated failure attribution.
  • [PROMPT_INJECTION]: The system is susceptible to indirect prompt injection during the scoring phase. The score_attribution.py script ingests raw output from SLURM job logs and interpolates it into a prompt for an LLM judge. While basic line filtering is implemented to hide the ground-truth fault from the judge, malicious workload output could potentially influence the LLM's assessment.
  • Ingestion points: Log file content read in scripts/score_attribution.py via the load_log_excerpt function.
  • Boundary markers: The LLM prompt uses markdown headers (e.g., ## Raw job log) to delimit external data.
  • Capability inventory: The skill can execute shell commands, perform file system operations on NFS/Lustre, and interact with SLURM's job scheduler (sbatch, srun, scontrol).
  • Sanitization: Log lines containing specific internal package markers are removed, but the text is not escaped to prevent instruction override.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 3, 2026, 11:06 AM
Security Audit — agent-trust-hub — nvrx-attr