tao-finetune-huggingface-model
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust, containerized workflow for model fine-tuning. Probes and training are conducted within Docker containers, isolating the host environment.
- [SAFE]: The skill follows security best practices by dropping root privileges inside the container using '--user $(id -u):$(id -g)', ensuring that generated files are owned by the host user.
- [SAFE]: Credentials such as 'HF_TOKEN' and 'WANDB_API_KEY' are handled as environment variables. The instructions explicitly state that the agent should only check for their presence and never read or display their values.
- [SAFE]: The workflow includes mandatory smoke tests and unit tests (Phase 4.5) to validate generated code against fake data before starting intensive GPU training.
- [SAFE]: The Static Analysis signals regarding 'eval()' are false positives; they refer to the standard PyTorch 'model.eval()' method for setting a neural network to evaluation mode, not the dangerous Python built-in function.
- [SAFE]: External downloads are limited to trusted sources including the NVIDIA NGC container registry, Hugging Face Hub, and official Hugging Face documentation/repository samples on GitHub.
Audit Metadata