fine-tuning-serving-openpi
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the official OpenPI repository and submodules from Physical Intelligence's GitHub (github.com/Physical-Intelligence/openpi). This is a well-known organization and the operation follows standard development practices.
- [EXTERNAL_DOWNLOADS]: Fetches pre-trained model checkpoints from official Google Cloud Storage buckets (gs://openpi-assets/checkpoints/) owned by the vendor.
- [COMMAND_EXECUTION]: Uses the
uvpackage manager for virtual environment creation and dependency resolution, including editable installations for local development. - [COMMAND_EXECUTION]: Executes training and inference scripts (scripts/train.py, scripts/serve_policy.py) which are part of the distributed repository.
- [SAFE]: Instructions correctly recommend using
.venvfor isolated dependency management and document standard GPU memory management flags (XLA_PYTHON_CLIENT_MEM_FRACTION) without malicious intent. - [SAFE]: Patching of the
transformerslibrary is documented as a specific requirement for OpenPI's PyTorch backend compatibility and targets known local directory paths.
Audit Metadata