slime-rl-training

Warn

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions require downloading code from an external repository at github.com/THUDM/slime.git and pulling a Docker image from slimerl/slime:latest to set up the environment.
  • [DYNAMIC_EXECUTION]: The slime framework provides command-line arguments, such as --custom-generate-function-path and --custom-rm-path, that enable the dynamic loading and execution of arbitrary user-provided Python scripts during the training process.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large external datasets, which presents a surface for indirect prompt injection attacks.
  • Ingestion points: Training and evaluation prompts are loaded from JSONL files via the --prompt-data and --eval-prompt-data arguments as shown in SKILL.md and references/api-reference.md.
  • Boundary markers: There are no documented instructions for using specific delimiters or markers to distinguish between data content and potential instructions within the ingested datasets.
  • Capability inventory: The skill environment executes subprocesses for model training, performs file system writes for checkpoints and logging, and initiates network operations for distributed training coordination.
  • Sanitization: No methods for sanitizing or validating ingested prompts are described in the provided workflows.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 9, 2026, 07:07 PM
Security Audit — agent-trust-hub — slime-rl-training