nanogpt-training

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent NanoGPT training guide with expected package installation and public dataset download steps, but users should pin dependencies and dataset revisions for safer reproducibility.

Before installing or using this skill, treat it as training guidance that will install large ML dependencies and download public dataset shards. For serious or shared environments, pin package versions, use a lockfile or hashes, pin Hugging Face dataset commits, verify checksums, and run training in an isolated environment without unnecessary secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-43
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install torch einops numpy huggingface_hub

python

image = modal.Image.debian_slim(python_version="3.11").pip_install(
    "torch", "einops", "numpy", "huggingface_hub"
)

Technical Analysis

The Skill installs third-party Python packages without pinning exact versions or verifying package hashes. Consequently, the dependencies resolved at execution time may differ from those reviewed during the audit.

Python packages can execute code during installation and import. If a package registry account, release pipeline, or resolved transitive dependency is compromised, a malicious release could execute with the permissions of the user or Modal container running the installation.

The dependencies are obtained from conventional package infrastructure rather than an evident typosquatting or personal package source. Therefore, this is a supply-chain hardening deficiency, not evidence that the currently named packages are malicious.

Attack Path

1. An attacker compromises a package publisher, distribution account, build pipeline, or transitive dependency.
2. The attacker publishes a malicious version under a dependency name accepted by the unpinned installation.
3. A user invokes the documented installation or builds the Modal image.
4. The package resolver selects the malicious or otherwise unreviewed release.
5. Attacker-controlled code runs during installation, import, or subsequent package use.

Impact Assessment

A successfully compromised package could execute arbitrary code within the installation or training environment. It could access files, environment variables, network connectivity, allocated compute resources, and any credentials made available to that process.

The reviewed Skill does not request elevated host permi ...[truncated 244 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version.
2. Generate and commit a lockfile that also fixes transitive dependency versions.
3. Require package hashes, such as through a hash-locked requirements file and pip install --require-hashes.
4. Build training images from reviewed, immutable base-image digests.
5. Use a trusted internal package mirror or otherwise restrict the permitted package indexes.
6. Run dependency vulnerability and provenance checks in CI before updating the lockfile.
7. Rebuild dependencies in an isolated environment without unnecessary secrets or host filesystem access.

T08 · Insecure Dependencies

Note

• Location: references/fineweb-data.md:23

Finding

FineWeb Dataset Download Is Not Pinned to an Immutable Revision

Content

View full analysis

Vulnerability Details

File Location: references/fineweb-data.md:23-28
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

python

hf_hub_download(
    repo_id="kjj0/fineweb100B-gpt2",
    filename=fname,
    repo_type="dataset",
    local_dir=data_dir,
)

Technical Analysis

The Skill downloads public training shards by repository and filename but does not provide an immutable Hugging Face commit revision or independently verify a cryptographic checksum.

The downloaded .bin files are memory-mapped as uint16 token arrays. They are not executed or loaded through an unsafe object-deserialization mechanism, so the reviewed behavior does not establish remote code execution. Nevertheless, repository mutation or compromise could silently replace the model’s training input after the Skill has been reviewed.

The download is necessary for the declared model-training functionality and uses an isolated temporary data directory, so it does not exceed the minimum filesystem privileges needed for the task. The weakness is the absence of artifact integrity and provenance controls.

The GitHub URL at references/fineweb-data.md:12 is attribution to an upstream source file only. The Skill neither downloads nor executes that Python file.

Attack Path

1. An attacker compromises the kjj0/fineweb100B-gpt2 dataset repository or its publishing process.
2. The expected shard filename is replaced while the repository identity remains unchanged.
3. A user runs download_fineweb_data().
4. hf_hub_download retrieves the modified shard because no immutable revision is specified.
5. The unverified tokens are consumed during model training, potentially poisoning model behavior or disrupting the training run.

Impact Assessment

A successful attack could poison the resulting model, corrupt evaluation results, impair reproducibility, or create malformed or unexpect ...[truncated 326 chars]

Remediation

View remediation

Remediation Suggestions

1. Pass an immutable reviewed commit identifier through the revision argument of hf_hub_download.
2. Publish expected SHA-256 digests and verify each shard before memory-mapping it.
3. Validate exact file sizes, token counts, and token-value ranges before training.
4. Reject symbolic links, unexpected filenames, and artifacts outside the intended data directory.
5. Cache verified artifacts in controlled storage so repeated training runs use identical inputs.
6. Document the dataset origin, commit revision, license, and verification procedure.

T08 · Insecure Dependencies

Note

• Location: references/tokenized-data.md:23

Finding

FineWeb-Edu Dataset Downloads Lack Revision and Checksum Verification

Content

View full analysis

Vulnerability Details

File Location: references/tokenized-data.md:23-28
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

python

hf_hub_download(
    repo_id="karpathy/fineweb-edu-100B-gpt2-token-shards",
    filename=fname,
    repo_type="dataset",
    local_dir=data_dir,
)

Technical Analysis

The alternate tokenized-data loader also relies on a mutable repository reference. It identifies shards by filename but does not pin a specific repository commit and does not verify artifact hashes.

The files are treated as raw uint16 arrays rather than executable programs or serialized Python objects. This substantially limits direct exploitation, but it does not protect the integrity or reproducibility of model training.

Downloading selected dataset shards is consistent with the Skill’s declared purpose and does not require elevated system privileges. The security deficiency is confined to supply-chain verification of remotely maintained training artifacts.

Attack Path

1. An attacker gains control of the dataset repository, a maintainer account, or its artifact publication process.
2. The attacker replaces one or more expected .bin shards with altered content.
3. A user invokes download_tokenized_data().
4. The loader obtains the altered files without checking an immutable revision or expected digest.
5. The loader selects the downloaded shards for training and validation.
6. Poisoned or malformed token data affects model behavior, reported metrics, or resource consumption.

Impact Assessment

Exploitation could compromise training-data provenance, introduce model poisoning, distort validation measurements, reduce reproducibility, or cause denial of service through malformed or oversized artifacts.

The documented loading path does not execute shard contents. No direct code-execution privileges, persistent system access, or privilege es ...[truncated 25 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Hugging Face dataset to an immutable commit using the revision parameter.
2. Maintain SHA-256 checksums for every permitted training and validation shard.
3. Verify each digest before opening the file with numpy.memmap.
4. Enforce maximum file sizes and expected token counts to prevent resource exhaustion.
5. Validate token identifiers against the configured GPT-2 vocabulary range.
6. Store verified shards in a read-only cache and record their provenance in training metadata.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.