tao-train-mask-auto-label

Warn

Audited by Socket on Aug 25, 2026

1 alert found:

Anomaly
AnomalyLOW
references/skill_info.yaml

This fragment is primarily a pipeline configuration that delegates all substantive behavior to an external tool/container executed with a runtime-generated configuration ({config_path}), using external templates and untrusted dataset/model artifacts. There is no direct evidence of malware (e.g., embedded payloads, obfuscated code, explicit exfiltration, or shell/backdoor behavior) within this YAML alone. However, multiple high-suspicion configuration indicators—unusual “mal” naming used as executable/arch, ambiguous container image reference, hardcoded-looking encryption_key value, marker-like inference output target, and relative template inclusion—raise meaningful supply-chain/configuration risk. A deeper review is required of the resolved templates and the actual container/tool implementation that performs “mal train/evaluate/inference.”

Confidence: 45%Severity: 60%
Audit Metadata
Analyzed At
Aug 25, 2026, 02:39 PM
Package URL
pkg:socket/skills-sh/nvidia%2Fskills%2Ftao-train-mask-auto-label%2F@26763c8e400502a2b41320ae4cf7bbc8efe1cb7e605d2cf88816bda989c60242
Security Audit — socket — tao-train-mask-auto-label