building-finetuning-datasets
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/generate.pyis designed to make network requests to external OpenAI-compatible API endpoints (e.g., Together AI, OpenAI, or local vLLM instances). These requests are used to generate synthetic training data and are configurable via the--base-urlargument andOPENAI_BASE_URLenvironment variable. - [COMMAND_EXECUTION]: The skill provides two Python utility scripts,
scripts/generate.pyandscripts/curate.py, which are intended to be executed by the user as part of the data preparation pipeline. These scripts use standard Python libraries for networking and file processing. - [DATA_EXFILTRATION]: The generation script transmits prompt instructions and taxonomy metadata to a remote LLM API. This is the primary and intended purpose of the tool to facilitate synthetic data creation. API keys are handled securely via environment variables or command-line flags.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its automated generation pipeline.
- Ingestion points:
scripts/generate.pyreads taxonomy axes from a JSON file and interpolates them into LLM prompts. - Boundary markers: The prompt template uses a basic structured request format but lacks explicit delimiters or instructions to ignore embedded content within the taxonomy variables.
- Capability inventory: The pipeline has the capability to perform network operations (API calls) and write files (
.jsonloutput). - Sanitization: The script performs basic JSON parsing and key extraction but does not sanitize the content of taxonomy values before they are interpolated into the prompt string.
Audit Metadata