The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides example implementations for custom reward functions that directly execute output generated by the model. Specifically, the code generation reward example extracts generated code from queries and executes it using subprocess.run. This pattern enables a model-to-code execution path where malicious model outputs can lead to arbitrary code execution.
Evidence: references/custom-rewards.md includes logic to write generated_code to a temporary file and run subprocess.run(["python", "-m", "pytest", temp_file], ...).
[PRIVILEGE_ESCALATION]: The skill's setup and multi-node training guides recommend running Docker containers with the SYS_ADMIN capability and using sudo for package management. The SYS_ADMIN capability is highly privileged and significantly expands the attack surface for container escape.
Evidence: Found in SKILL.md and references/multi-node-training.md as docker run --runtime=nvidia -it --rm --shm-size="10g" --cap-add=SYS_ADMIN ....
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted model-generated content within training and feedback loops that have access to command execution capabilities. This surface allows for indirect prompt injection where adversarial data in the training set could influence the model to generate outputs that trigger unintended logic in the reward or agent functions.
Ingestion points: The reward_func in references/custom-rewards.md ingests queries, prompts, and labels; the AgentInstance class ingests action_text and observation_text.
Boundary markers: None; untrusted text is processed directly as strings.
Capability inventory: The skill uses subprocess.run and file writes within these processing paths.
Sanitization: No sanitization is performed on model outputs before they are processed or executed.
[COMMAND_EXECUTION]: The skill relies on shell commands for environment setup and runtime evaluation, including uninstallation of packages via sudo and executing model outputs through subprocess. The interpolation of potentially untrusted inputs into these commands increases the risk of command injection.
Evidence: Examples include sudo pip uninstall ... in SKILL.md and subprocess.run calls in references/custom-rewards.md.

openrlhf-training