The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download a Docker image and clone a Git repository from sources hosted by the 'radixark' account. This account is neither a recognized trusted organization nor is it identified as a naming pattern for the verified vendor 'qcmuu'.
Evidence: docker pull radixark/miles:latest and git clone https://github.com/radixark/miles.git in SKILL.md.
[REMOTE_CODE_EXECUTION]: The installation and execution workflows involve downloading external code and running it with local system privileges.
Evidence: The 'From source' installation instructions in SKILL.md combine cloning a remote repository with pip install -e . and subsequent execution via python train.py.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external datasets for training RL models, creating a vulnerability surface where malicious instructions in the data could compromise the training process or the resulting model.
Ingestion points: Training scripts ingest untrusted prompt data via the --prompt-data argument (specified in SKILL.md).
Boundary markers: The skill does not suggest the use of delimiters or warnings to prevent the training process from following embedded instructions in the dataset.
Capability inventory: The training pipeline executes complex ML logic, manages distributed processes (Ray/Megatron-LM), and writes model checkpoints to the file system.
Sanitization: There is no documentation of input validation or sanitization for the training prompt data.
[METADATA_POISONING]: The skill's metadata contains conflicting identity information which can mislead users regarding the source of the code.
Evidence: The YAML frontmatter in SKILL.md lists the author as 'Orchestra Research', whereas the verified vendor context is 'qcmuu'. This discrepancy is compounded by the use of 'radixark' for hosting the primary software resources, creating a fragmented and difficult-to-verify trust chain.

miles-rl-training