kermt-pretrain-scratch
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runacross several utility and orchestration scripts (scripts/_utils.py,scripts/prepare_data.py,scripts/run_pretrain_local.py) to interface with local development tools such asgitanddocker. This execution is a core component of the skill's functionality to manage model training pipelines. - [PRIVILEGE_ESCALATION]: Execution depends on
docker, which often requires elevated system permissions (e.g., membership in thedockergroup). The skill mitigates common container security risks by mapping the container user to the host's UID/GID and mounting host volumes as read-only where possible. - [DYNAMIC_EXECUTION]: In
scripts/_utils.py, the skill implements a restrictedpickle.Unpickler(_VocabUnpickler) to load vocabulary files. This implementation limits unpickling to a small set of safe, predefined classes (collections.Counter,re.compile), preventing the execution of arbitrary code during data loading. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by ingesting and processing untrusted CSV datasets provided by users. These files are parsed by RDKit for chemical validation. While this is an inherent risk in data-processing tools, the skill uses established libraries for validation and limits the scope of the ingested data to training context.
Audit Metadata