miles-rl-training
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading a Docker image (
radixark/miles:latest) and cloning a repository (https://github.com/radixark/miles.git) from an untrusted organization. - [REMOTE_CODE_EXECUTION]: The skill executes code from an untrusted source by cloning a repository and performing an editable installation (
pip install -e .), which runs the package's setup scripts. - [INDIRECT_PROMPT_INJECTION]: The skill processes external training data from a JSONL file (
--prompt-data /path/to/data.jsonl). This ingestion point lacks explicit boundary markers or sanitization instructions, creating a surface for indirect prompt injection if the data contains malicious instructions targeting the training pipeline. - Ingestion points: Training data file specified via
--prompt-data(SKILL.md). - Boundary markers: None specified in the instructions.
- Capability inventory: Includes subprocess execution (
python train.py), filesystem access for checkpoints and data, and environment variable modification. - Sanitization: No mention of input validation or prompt escaping for the training data.
Audit Metadata