The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and downloads code from the meta-pytorch organization on GitHub (github.com/meta-pytorch/torchforge, github.com/meta-pytorch/monarch) and the meta-pytorch.org domain. These sources are not recognized as official entities of the PyTorch project or its parent organization. The skill also downloads the torchtitan library from the official PyTorch GitHub repository.
[COMMAND_EXECUTION]: The instructions require the user to execute shell scripts located in the ./scripts/ directory, specifically install.sh and install_rocm.sh. The contents of these scripts are not included in the provided files, making their actions unverifiable and potentially risky.
[METADATA_POISONING]: The skill metadata and description claim the library is "Meta's PyTorch-native RL library." However, the associated links use the meta-pytorch namespace, which is distinct from official organizations such as facebook, pytorch, or meta-llama. This discrepancy may mislead users regarding the software's origin and safety.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external training data, which creates a surface for indirect prompt injection attacks where malicious data could influence agent behavior during the training process.
Ingestion points: Training datasets defined in the config/grpo_math.yaml configuration and HuggingFace dataset paths mentioned in SKILL.md.
Boundary markers: None. The skill does not provide delimiters or instructions to ignore potential commands embedded in the dataset content.
Capability inventory: The skill facilitates the execution of training scripts (apps.grpo.main) and environment setup scripts that could be targeted by injected content.
Sanitization: No evidence of input validation, filtering, or sanitization for external dataset content was found.

torchforge-rl-training