The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill relies on 'trust_remote_code=True' to load model weights and tokenizers from both remote and local checkpoints. This setting enables the execution of arbitrary Python code provided within the checkpoint directory during the loading process.
[DYNAMIC_EXECUTION]: The HumanEval benchmark evaluation scripts, including 'eval/evaluate_humaneval.py', are designed to execute code generated by the language model. The skill documentation warns that this should only be performed in a sandbox environment to mitigate risks from untrusted code.
[DYNAMIC_EXECUTION]: The 'scripts/check_qwen_environment.py' script uses 'importlib.import_module' to dynamically load and check the versions of dependencies such as 'torch', 'transformers', and 'tiktoken' without performing weight loading.
[PRIVILEGE_ESCALATION]: Workflows for vendor-specific accelerators like Ascend NPU and Hygon DCU require high-privilege operations, including mounting host devices (e.g., '/dev/davinci*', '/dev/kfd'), using 'seccomp=unconfined', and granting 'SYS_PTRACE' capabilities to Docker containers.
[COMMAND_EXECUTION]: The skill generates and recommends complex shell commands for 'docker run', 'torchrun', and 'deepspeed'. While it provides dry-run helpers to display these commands to the user, the eventual execution involves significant system interaction and resource management.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (fine-tuning datasets, benchmark data, and tool schemas) that could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through JSON fine-tuning samples and external benchmark files.
Boundary markers: The skill uses ChatML role tags ('<|im_start|>', '<|im_end|>') as delimiters, though these can be targeted by adversarial input.
Capability inventory: The skill can execute subprocesses via 'torchrun', 'deepspeed', and 'docker run' across various scripts.
Sanitization: The skill provides instructions for tokenizer-level sanitization using 'allowed_special' and 'disallowed_special' settings to prevent control-token injection in untrusted text.

qwen