building-finetuning-datasets

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/generate.py is designed to make network requests to external OpenAI-compatible API endpoints (e.g., Together AI, OpenAI, or local vLLM instances). These requests are used to generate synthetic training data and are configurable via the --base-url argument and OPENAI_BASE_URL environment variable.
  • [COMMAND_EXECUTION]: The skill provides two Python utility scripts, scripts/generate.py and scripts/curate.py, which are intended to be executed by the user as part of the data preparation pipeline. These scripts use standard Python libraries for networking and file processing.
  • [DATA_EXFILTRATION]: The generation script transmits prompt instructions and taxonomy metadata to a remote LLM API. This is the primary and intended purpose of the tool to facilitate synthetic data creation. API keys are handled securely via environment variables or command-line flags.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its automated generation pipeline.
  • Ingestion points: scripts/generate.py reads taxonomy axes from a JSON file and interpolates them into LLM prompts.
  • Boundary markers: The prompt template uses a basic structured request format but lacks explicit delimiters or instructions to ignore embedded content within the taxonomy variables.
  • Capability inventory: The pipeline has the capability to perform network operations (API calls) and write files (.jsonl output).
  • Sanitization: The script performs basic JSON parsing and key extraction but does not sanitize the content of taxonomy values before they are interpolated into the prompt string.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 07:39 AM
Security Audit — agent-trust-hub — building-finetuning-datasets