trainer-train-code
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests and processes external datasets and source code to drive its orchestration logic.
- Ingestion points: The skill ingests data from
datasets/train.jsonl,datasets/val.jsonl, and external Python source files (.py) provided as optimization targets. - Capability inventory: The orchestration loop executes shell-based feedback commands (e.g.,
pytest, benchmark scripts) and performs file system writes to the.trainer-workspace/directory. - Boundary markers: The skill does not define explicit boundary markers or instructions to ignore instructions embedded within the training datasets or target source code.
- Sanitization: There is no evidence of input validation or sanitization for the data processed during the optimization and validation iterations.
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands provided as "feedback signals" (such as
python -m pytest -qor benchmark scripts). While this is a core requirement for its primary purpose of code optimization, it represents an execution capability that could be misused if provided with malicious test commands.
Audit Metadata