tinker-rlskill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:55 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Tinker SDK guide, but it should be reviewed because it encourages mutable package upgrades, broad activation, secret-printing diagnostics, and public or destructive checkpoint operations without strong safeguards.

Install only if you are comfortable with an agent helping manage Tinker checkpoints and Hugging Face uploads. Before use, pin package versions or run setup in an isolated environment, avoid printing API keys, prefer ephemeral credentials or protect `~/.tinker/config.json` with restrictive permissions, and require explicit confirmation before installing/upgrading packages, deleting checkpoints, publishing checkpoints, or pushing artifacts to public repositories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30

Finding

Automatic Installation of Unpinned and Mutable Upstream Dependencies

Content

View full analysis

&& git pull && uv pip install -e . ``` When you need more detailed information about API internals, recipe implementations, or SDK source code, always check the latest code from these repos — do NOT rely on cached or outdated knowledge. Clone or browse the repos directly to get up-to-date APIs and options. ``` Related unpinned installation instructions include: ```bash pip install huggingface_hub uv pip install -e ".[modal]" ``` ### Technical Analysis The Skill explicitly requires the Agent to upgrade the `tinker` package and pull the latest state of an external Git repository before operating it. Neither the Python package nor the Git repository is pinned to an audited version, immutable commit SHA, lockfile, or expected cryptographic hash. Running `uv pip install -e .` can process attacker-controlled packaging metadata and install transitive dependencies. Depending on the package build system and subsequent imports or entry-point execution, code supplied by the mutable upstream repository may execute locally. The effective code therefore can change after this Skill has been reviewed. The same problem affects optional dependencies installed through unversioned package names. Although the documented package names and repositories appear legitimate, the instructions do not provide integrity verification or protection against a compromised upstream release, repository acc ...[truncated 1488 chars]

Remediation

View remediation

" ``` 2. Maintain a lockfile with cryptographic hashes and install dependencies using hash verification. 3. Replace `git pull` with checkout of an immutable, reviewed commit SHA: ```bash git fetch --depth 1 origin git checkout --detach ``` 4. Verify repository remotes, signed commits or tags, and package provenance before installation. 5. Remove the instruction to “always use the latest version.” Require an explicit review and approval step before upgrades. 6. Perform installation and recipe execution in an isolated virtual environment or sandbox with minimal filesystem, credential, and network access. 7. Pin optional and transitive dependencies, not only the primary Tinker package. 8. Avoid editable installation for routine usage. Build and verify a reproducible artifact before installing it. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/troubleshooting.md:29

Finding

Authentication Troubleshooting Commands Expose Complete API Credentials

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:3

Finding

Overbroad Skill Activation Allows Unrelated Sessions to Inherit Operational Instructions

Content

View full analysis

Use this skill whenever the user mentions Tinker, tinker CLI, training runs, checkpoints, model fine-tuning with Tinker, tinker-cookbook, tinker recipes, or any Thinking Machines AI SDK operations. Also trigger when users ask about listing/inspecting/downloading/deleting training checkpoints, pushing checkpoints to HuggingFace, managing checkpoint TTL, configuring post-training pipelines (SFT, RL, math RL, code RL, distillation, preference learning, RLHF, tool use training, multi-agent RL, prompt distillation, rubric grading, VLM classification, Harbor RL), or working with tinker:// paths. Use this skill even if the user just mentions "tinker" in passing — it covers the full Tinker ecosystem including CLI, Python SDK, and cookbook recipes. ``` ### Technical Analysis The activation description explicitly instructs the Agent to load the Skill even when “tinker” is mentioned only in passing. This is broader than task-based activation and allows the Skill’s installation and operational guidance to influence requests that do not require Tinker functionality. The Skill does not explicitly instruct the Agent to bypass safety controls, alter persistent memory, or conceal its behavior. Consequently, this is a limited instruction-scope weakness rather than evidence of a malicious hijacking payload. However, unnecessary activation increases exposure to the Skill’s unpinned installation guidance and high-impact checkpoint operations. ### Attack Path 1. A user or untrusted document includes the word “tinker” incidentally in an otherwise unrelated request. 2. The activation rule causes the Agent to load this Skill despite the absence of a Tinker operation. 3. The Skill introduces instructions concerning package upgrades, repository pulls, checkpoint dele ...[truncated 1031 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger scope is intentionally overbroad and instructs activation even when the word 'tinker' is mentioned only in passing. That can cause the agent to invoke this skill in unrelated contexts, increasing the chance it follows risky operational guidance or requests secrets, performs external package installs, or suggests destructive commands without sufficient relevance checks.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-reference.md (reported line 231)May include surrounding context.

md

## tinker checkpoint set-ttl

Set or remove checkpoint expiration.

| Option | Type | Description |
|--------|------|-------------|

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill recommends storing an API key in a persistent file under ~/.tinker/config.json. While common for CLI tools, persistent credential storage increases exposure to local compromise, accidental inclusion in backups, weak file permissions, or leakage through copied home directories; in a skill context, normalizing this without security caveats is risky.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

export TINKER_API_KEY="your-api-key"

Option 2: Config file (~/.tinker/config.json)

mkdir -p ~/.tinker echo '{"api_key": "your-api-key"}' > ~/.tinker/config.json

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes commands for publishing checkpoints, deleting checkpoints, changing TTL, and pushing artifacts to Hugging Face, but it does not pair them with explicit safety warnings or confirmation requirements. In an agent setting, this raises the risk of unintended data exposure, irreversible deletion, or propagation of sensitive model artifacts to public destinations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation describes making checkpoints public but does not warn that checkpoints can contain proprietary model weights, training artifacts, or sensitive information that will become accessible to others. In this skill context, users are explicitly guided to manage and publish checkpoints, so omission of an exposure warning materially increases the chance of accidental data leakage.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/cli-reference.md (reported line 271)May include surrounding context.

| --type | str | weights or sampler_weights | | --before | str | ISO 8601 date (UTC) | | --after | str | ISO 8601 date (UTC) | | -y, --yes | flag | Skip confirmation |

bash

tinker checkpoint delete --run-id run-abc123 \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The push-to-HuggingFace command uploads checkpoint contents to an external third-party service and supports creating public repos, but the reference does not clearly warn about external disclosure risks. Because this skill is specifically for checkpoint and model-management workflows, users may reasonably follow the example and unintentionally exfiltrate sensitive model artifacts or publish them publicly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.