slime-rl-training
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions require downloading code from an external repository at
github.com/THUDM/slime.gitand pulling a Docker image fromslimerl/slime:latestto set up the environment. - [DYNAMIC_EXECUTION]: The slime framework provides command-line arguments, such as
--custom-generate-function-pathand--custom-rm-path, that enable the dynamic loading and execution of arbitrary user-provided Python scripts during the training process. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large external datasets, which presents a surface for indirect prompt injection attacks.
- Ingestion points: Training and evaluation prompts are loaded from JSONL files via the
--prompt-dataand--eval-prompt-dataarguments as shown inSKILL.mdandreferences/api-reference.md. - Boundary markers: There are no documented instructions for using specific delimiters or markers to distinguish between data content and potential instructions within the ingested datasets.
- Capability inventory: The skill environment executes subprocesses for model training, performs file system writes for checkpoints and logging, and initiates network operations for distributed training coordination.
- Sanitization: No methods for sanitizing or validating ingested prompts are described in the provided workflows.
Audit Metadata