nanochat-llm-training
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to download and execute an installation script for the
uvpackage manager usingcurl -LsSf https://astral.sh/uv/install.sh | sh. This pattern involves piping remote content directly to a shell. The sourceastral.shis the official domain for Astral, a well-known provider of high-performance Python developer tools. - [EXTERNAL_DOWNLOADS]: The skill clones the
nanochatsource code repository from GitHub (https://github.com/karpathy/nanochat.git) to obtain the training harness and scripts. - [COMMAND_EXECUTION]: Multiple commands are provided to execute local Python scripts and shell scripts for training and evaluation, including
torchrunfor distributed training andsubprocess.runwithin Python examples to manage training processes. - [DATA_EXFILTRATION]: The instructions describe serving a web-based chat interface (
scripts.chat_web) and suggest accessing it via the host's public IP on port 8000. This involves opening a network port to external traffic, which is a standard requirement for the described chat UI functionality. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of a chat environment that ingests untrusted user input.
- Ingestion points: Data enters the system through the
scripts/chat_web.pyandscripts/chat_cli.pyinterfaces during inference. - Boundary markers: None are explicitly defined in the skill instructions to separate user input from system instructions within the generated chat environment.
- Capability inventory: The environment includes capabilities for file system writes (checkpointing), network serving (web UI), and execution of training processes via
torchrunandsubprocess. - Sanitization: No specific sanitization or filtering logic for external prompt content is detailed in the provided instructions.
Audit Metadata