i4h-workflow-finetune
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill clones a remote Git repository from a configurable URL (
I4H_WORKFLOWS_REPO_URL) and executes a shell script (./run.sh) and project-specific training commands viauv run. This creates a pathway for executing arbitrary code retrieved from an external source. - [EXTERNAL_DOWNLOADS]: The skill downloads content from
https://github.com/isaac-for-healthcare/i4h-workflows(default) or a user-specified URL to establish its working environment. - [INDIRECT_PROMPT_INJECTION]: The skill parses untrusted external files to resolve training configurations, which could allow malicious instructions in those files to influence agent behavior.
- Ingestion points: Remote task manifests (
.yaml), dataset metadata (meta/info.json), and project training scripts (train.py). - Boundary markers: No explicit delimiters or instructions were found to prevent the agent from following commands embedded within these processed files.
- Capability inventory: Shell execution (
git,./run.sh,uv), file system access, and GPU monitoring (nvidia-smi). - Sanitization: There is no evidence of validation or sanitization of the content within the manifests or scripts before they are used to drive the workflow.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands, including
nvidia-smi,git clone, and variousuv runinvocations for training and inference server smokes.
Audit Metadata