i4h-workflow-train-rl
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones the Isaac for Healthcare workflows repository from
https://github.com/isaac-for-healthcare/i4h-workflowsif the repository is not already present in the expected local path. This is a standard setup step for accessing the necessary training scripts and environment configurations. - [COMMAND_EXECUTION]: The instructions require the agent to execute several local shell scripts, including
./train.shand./run.sh, to manage the training, evaluation, and export lifecycle of RL policies. These commands are integral to the skill's primary function of training robotic models. - [INDIRECT_PROMPT_INJECTION]: The skill processes declarative YAML configurations and Scene manifests which could be manipulated by an attacker if the repository content is compromised.
- Ingestion points: The agent is instructed to read profiles under
./rl/profiles/, trainer configurations under./rl/config/, and Scene manifest implementations. - Boundary markers: The instructions do not specify the use of delimiters or specific security warnings to the agent regarding instructions that might be embedded within these configuration files.
- Capability inventory: The skill has the capability to read files from the local system and execute commands via the
./train.shand./run.shentry points. - Sanitization: The process includes a
--dry-runphase intended to verify source existence and basic schema consistency, but it does not detail robust sanitization or sandboxing of the interpreted configuration data.
Audit Metadata