together-ai
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and execute an installation script from Together AI's official domain (
https://link.together.ai/install) to set up the TogetherLink utility. This is a vendor-owned resource. - [EXTERNAL_DOWNLOADS]: The Kubernetes management guides (
domains/kueue.md,domains/volcano.md) fetch configuration manifests from trusted or well-known organizations, specifically the Kubernetes SIGs repository (github.com/kubernetes-sigs/kueue) and the Volcano project repository (github.com/volcano-sh/volcano). - [INDIRECT_PROMPT_INJECTION]: The skill features workflows for model evaluation and fine-tuning (
scripts/evaluations/run_evaluation.py,scripts/fine-tuning/finetune_workflow.py) that ingest untrusted user datasets in JSONL format. These data points are interpolated into prompts and model templates, representing a potential injection surface for malicious datasets, although this is inherent to the skill's primary function of AI development. - [COMMAND_EXECUTION]: The skill facilitates the management of remote GPU clusters and inference endpoints through the Together CLI (
tg) andkubectl. These operations are administrative in nature and consistent with the platform's orchestration capabilities.
Audit Metadata