together-ai

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and execute an installation script from Together AI's official domain (https://link.together.ai/install) to set up the TogetherLink utility. This is a vendor-owned resource.
  • [EXTERNAL_DOWNLOADS]: The Kubernetes management guides (domains/kueue.md, domains/volcano.md) fetch configuration manifests from trusted or well-known organizations, specifically the Kubernetes SIGs repository (github.com/kubernetes-sigs/kueue) and the Volcano project repository (github.com/volcano-sh/volcano).
  • [INDIRECT_PROMPT_INJECTION]: The skill features workflows for model evaluation and fine-tuning (scripts/evaluations/run_evaluation.py, scripts/fine-tuning/finetune_workflow.py) that ingest untrusted user datasets in JSONL format. These data points are interpolated into prompts and model templates, representing a potential injection surface for malicious datasets, although this is inherent to the skill's primary function of AI development.
  • [COMMAND_EXECUTION]: The skill facilitates the management of remote GPU clusters and inference endpoints through the Together CLI (tg) and kubectl. These operations are administrative in nature and consistent with the platform's orchestration capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 11:23 PM