Skill

issue

skill:verl-project/verl#issue

Create or update a GitHub issue following verl project conventions.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:31 UTC at 4d3ed12

findings

high

highest severity

threat classes

1,299

files scanned

2,527/2,543

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agent/skills/issue:.agent/skills/issue/SKILL.md:28:CRED
suspicious: finding skill:.agent/skills/issue:scripts/diagnose.py:172:CRED
suspicious: finding skill:.agent/skills/issue:scripts/diagnose.py:173:CRED
suspicious: finding skill:.agent/skills/issue:verl/protocol.py:413:EXEC
suspicious: finding skill:.agent/skills/issue:verl/utils/fs.py:214:SUPPLY
suspicious: finding skill:.agent/skills/issue:verl/utils/hdfs_io.py:140:EXEC
suspicious: finding skill:.agent/skills/issue:verl/utils/import_utils.py:188:EXEC
suspicious: finding skill:.agent/skills/issue:verl/utils/import_utils.py:88:EXEC
suspicious: finding skill:.agent/skills/issue:verl/utils/profiler/config.py:1:EXEC
suspicious: finding skill:.agent/skills/issue:verl/utils/profiler/profile.py:281:CRED

Security findings 10

Credential access

highContextual risklow confidence

The skill instructs the agent, when composing a bug report, to run the bundled scripts/diagnose.py, which a deterministic detector flags as reading all environment variables (os.environ.items), and the bug-report template directs that the script's output be pasted into the GitHub issue body, risking disclosure of env-borne secrets to a public issue.

.agent/skills/issue/SKILL.md:28

run `python scripts/diagnose.py` to gather system info if possible

trigger:conditionalvector:instruction

Counter-argument considered

The skill instructs running the script and the required System Info field directs pasting its output into the public issue body while the script prints matching environment values unredacted; the env print is declared nowhere beyond the 'system info' purpose, and the template documentation does not neutralize the disclosure hazard.

Credential access

highContextual riskmedium confidence

Undeclared by the skill description: the bug-report workflow instructs the agent to run scripts/diagnose.py and paste its output into a public GitHub issue, and the script reads the entire process environment and prints the values of variables matching VERL_*/OMP_*/KMP_* plus CC/CXX (the full-environment-dump lead is overstated because printing is name-filtered, but the read spans os.environ.items()).

scripts/diagnose.py:172

for k, v in os.environ.items():

vector:codevector:mixed

Counter-argument considered

The script reads the whole environment and prints matching values unredacted to stdout, which the skill-driven bug-report workflow then pastes into a public issue body; this env print is undeclared residue beyond the 'system info' declaration, so the contextual disclosure finding stands.

Credential access

highContextual riskmedium confidence

The default run of scripts/diagnose.py prints every VERL_*, OMP_*, KMP_*, CC and CXX environment variable unredacted to stdout, and the issue skill has the agent run it and fill the output into a GitHub issue body.

scripts/diagnose.py:173

if k.startswith(

vector:code

Counter-argument considered

The environment check runs by default (all diagnostic flags default to 1), prints the VERL_*/OMP_*/KMP_*/CC/CXX values unredacted, and the skill has the agent fill that output into the GitHub issue body — a concrete, undeclared disclosure chain that the name filter narrows but does not neutralize.

Credential access

highContextual riskmedium confidence

verl's profiler finish hook copies the entire process environment, which typically holds tokens, and passes it to an operator-configured shell command; this collection of the full environment is undeclared by the target's stated purpose of creating GitHub issues.

verl/utils/profiler/profile.py:281

env = os.environ.copy()

vector:code

Counter-argument considered

The mechanism is real and concretely wired: _run_finish_command copies the entire process environment and hands it to the operator command through /bin/sh -c with env=env; the only gate is an externally supplied finish_hook_cmd, so the finding stands at contextual severity with chain absent, and nothing in the evidence neutralizes it.

Code execution

mediumContextual risklow confidence

The bundled verl utility verl/utils/hdfs_io.py defines _run_cmd, which executes its command string through os.system, giving any caller that interpolates values into that string arbitrary shell execution, although the issue skill's instructions never invoke this module.

verl/utils/hdfs_io.py:140-141

return os.system(cmd)

vector:code

Counter-argument considered

Accurate: the shipped module defines an os.system wrapper and shown callers interpolate path arguments into the command string, a genuine arbitrary shell-execution sink; the finding itself concedes no skill instruction invokes the module, which is a chain absence, not a refutation.

Code execution

mediumContextual risklow confidence

The bundled verl utility verl/utils/import_utils.py load_module builds an importlib spec from any pkg:// or file:// path and calls spec.loader.exec_module, executing arbitrary Python code from whatever file the path resolves to at runtime, though no skill instruction feeds it a path.

verl/utils/import_utils.py:188-189

spec.loader.exec_module(module)

vector:code

Counter-argument considered

Accurate: load_module turns any pkg:// or file path into an importlib spec and calls spec.loader.exec_module, a real dynamic code-execution primitive shipped undeclared by the issue-authoring skill; no shown instruction feeds it a path, which is chain absence only.

Code execution

mediumContextual risklow confidence

The bundled import utilities (residue R96-R98, adjudicated unexplained) dynamically import and execute arbitrary caller-supplied Python modules via import_external_libs, load_module's spec.loader.exec_module, and load_class_from_fqn, a dynamic code-execution capability undeclared for creating or updating GitHub issues.

verl/utils/import_utils.py:88

importlib.import_module(external_lib)

vector:code

Counter-argument considered

Accurate: import_external_libs imports whatever module names callers pass and the same file ships load_module's exec_module and load_class_from_fqn, a real dynamic import/exec surface undeclared by the skill; dormancy is only a chain absence.

Code execution

mediumContextual risklow confidence

The shipped verl profiler surface documents and implements a user-configured shell hook (finish_hook_cmd) that executes an arbitrary command through a shell on selected training ranks after profiling (e.g. uploading the accumulated trace directory off the node), an arbitrary-command-execution sink whose payload depends entirely on runtime configuration and is not evidenced as set to anything harmful here.

verl/utils/profiler/config.py:1-567

Shell command executed on the selected ranks **once**, after the last profiled step

vector:code

Counter-argument considered

Accurate and concrete: the shipped profiler implements the operator-configured finish_hook_cmd by routing it through /bin/sh -c via subprocess.Popen on selected ranks, a real shell-execution sink; that the artifact supplies no harmful payload is a trigger/chain absence, not a refutation.

Code execution

lowContextual risklow confidence

DataProto deserialization executes arbitrary embedded code via torch.load(weights_only=False) in __setstate__ and pickle.load in load_from_disk on caller-supplied file paths with no integrity check, so loading a crafted DataProto file runs attacker code.

verl/protocol.py:413-417

weights_only=False,

vector:code

Counter-argument considered

A real unsafe-deserialization source→sink ships in the code — a caller-supplied path flows into pickle.load and torch.load(weights_only=False) with no integrity check — and nothing declares it; the issue-creation workflow never executes this path, which lowers severity but does not refute.

Supply chain

lowContextual risklow confidence

The shipped verl helper copy_to_local downloads an arbitrary Hugging Face repository with snapshot_download when use_shm is enabled and the local path is missing, an undeclared remote-content fetch not needed to create or update GitHub issues.

verl/utils/fs.py:214-224

resolved = snapshot_download(local_path)

vector:code

Counter-argument considered

Accurately describes a real, undeclared remote-fetch primitive: with use_shm set and the local path missing, copy_to_local treats the caller-supplied path as a Hugging Face repo and snapshot_downloads it; nothing shown refutes the capability, and dormancy is only a chain absence.

Open questions 37

What the analysis could not settle from the code alone.

Detector lead reports scripts/diagnose.py referencing network host mirrors.tuna.tsinghua.edu.cn (an anaconda package mirror); the file is not among this pass's units, so whether this network access matches a declared download purpose could not be verified from the shown evidence.

Data exfiltration

Detector lead reports verl/models/mcore/patch.py dynamically importing 'fast_hadamard_transform' via importlib; the file is not among this pass's units, so the resolution source of that import could not be verified from the shown evidence.

Code execution

The units attributed to the 'issue' skill (declared: create or update a GitHub issue) are exclusively decoded docstrings/comments from the verl training library with no issue-related content or agent-directed instructions shown; confirm how the skill actually surfaces these files before treating the scope mismatch as suspicious.

check_verl() imports the verl package, and verl/__init__.py executes import_external_libs for VERL_USE_EXTERNAL_MODULES and loads 'verl.plugins' entry_points at import time; whether any such external code executes during the diagnose run is not determinable from the shown artifact.

Code execution

Whether the verl/* library units in this batch (verl/models/mcore/patch.py, verl/models/mcore/util.py, verl/models/mcore/mtp_patch.py, verl/plugin/platform/*) are consumed by or shipped as payload of the .agent/skills/issue skill at all, versus being unrelated repository content: residue items R24, R25, and R26 were adjudicated as unexplained-but-transparent relative to the skill's declared purpose of creating GitHub issues, but if these files are not on the skill's execution surface the residue⟦… 80 more chars …⟧

The owed units in this batch are verl RL-training framework sources (algorithm/checkpoint config dataclasses and FSDP/Megatron distillation loss implementations, including docstrings describing an external-module load/execute config) that have no apparent role in the skill's declared purpose of creating or updating GitHub issues; whether these files are shipped inside the skill root, referenced by the skill's instructions, or merely scanned as repository context cannot be settled from the units ⟦… 148 more chars …⟧

Residue R102-R113 (Megatron checkpoint-path helpers creating directories via local_mkdir_safe/os.makedirs) is undeclared for GitHub-issue authoring and adjudicated unexplained, but it matches no capability class, so it is recorded here rather than as a finding.

The target declares 'Create or update a GitHub issue following verl project conventions', yet this batch's units are verl's ML profiler subsystem (trace relocation, vLLM env exports, a finish-hook shell command, full-environment collection); whether the issue skill ever invokes, configures, or ships execution of these modules is not shown in this batch.

Scope of the declaration: the target declares a GitHub issue-creation skill, but all 75 owed units are verl framework library code (SGLang FP8/FP4 quantization refit utilities, tensordict helpers, tokenizer helpers) that the agent does not execute as part of issue creation. Residue R146/R147 (read/write of SGLANG_FP8_IGNORED_LAYERS in verl/utils/sglang/sglang_quant_utils.py) was adjudicated as necessary for the module's documented role (mirroring ignored layers to SGLang scheduler subprocesses v⟦… 429 more chars …⟧

Residue R149 (read of VERL_DISABLE_FLASH_ATTN_CE in verl/utils/torch_functional.py) and R159 (dynamic env read of the VERL_RL_INSIGHT_ENABLE flag in RLInsightLogger) are verl library feature-flag reads matching no capability class; deciding between necessary and unexplained for the issue skill depends on whether the skill ever executes or imports these modules, which this batch does not show.

Residue R160-R163 and R165 (reads of VERL_FILE_LOGGER_PATH/VERL_FILE_LOGGER_ROOT and TENSORBOARD_DIR with local JSONL and Tensorboard event-file writes) are local log-file writes by the verl tracking module, undeclared relative to the issue skill but plainly visible; they match no capability class beyond ordinary logging and their reachability from the skill's execution surface is not established.

All units in this batch are verl repository library files (verl/utils/*) rather than the skill files under .agent/skills/issue; whether the declared issue-creation skill itself invokes, imports, or ships any of this code (including the exec()-based patch module) is not established by the evidence shown.

Residue R167/R168 (TENSORBOARD_DIR env read and SummaryWriter file write in verl/utils/tracking.py) and R169/R172 (VERL_LOGGING_LEVEL env reads) were adjudicated as necessary for a training framework's own tracking/logging modules; if the artifact scope is strictly the GitHub-issue skill, these would instead be unexplained repo code — the scope relationship is unresolved.

Residue R178 flags a dynamic file_read via copy at verl/workers/config/optimizer.py line 77, but the cited unit (lines 64-86) contains only a dataclass definition with no file-read operation; what mechanism performs this read (for example a skill instruction or copy helper referencing this file)?

Residue R179 flags a dynamic file_read via copy at verl/workers/config/optimizer.py line 103, but the cited unit (lines 87-126) contains only a dataclass definition with no file-read operation; what mechanism performs this read?

Residue R180 flags a dynamic file_read via copy at verl/workers/config/optimizer.py line 273, but the cited unit (lines 254-297) contains only a dataclass definition with no file-read operation; what mechanism performs this read?

The owed units in this batch are verl training-framework source files (verl/workers/...), not content of the .agent/skills/issue skill itself; whether the declared description 'Create or update a GitHub issue following verl project conventions' is meant to cover repository source cannot be settled from the units shown. The residue items R183-R205 were adjudicated against the code's evident distributed-training purpose and all judged necessary: determinism env writes (os.environ setdefault of NCC⟦… 372 more chars …⟧

Residue R206-R209 and R210-R212 were adjudicated as necessary plumbing of the verl library itself (VERL_FULL_DETERMINISM/VERL_SEED gating enable_full_determinism, the VLLM_ASCEND_REQUIRED_ENV_VARS in-process env fill for NPU compatibility, and VERL_REPLICA_RANK/VERL_RAY_JOB_ID/VERL_ZMQ_BASE_TRAINER_RANK naming a local ipc:///tmp ZMQ socket); this adjudication is contingent on the unconfirmed assumption that verl source files are in the artifact's scope as the subject matter the GitHub-issue skil⟦… 138 more chars …⟧

Decoded units SRC:44c9a66ca2c2baf6, SRC:4e8636683e11a4f6, and SRC:14e24f8e898cfa1a reproduce only Apache-2.0 license headers and benign docstrings/comments that match the adjacent plain-source units (no hidden payload found), but the encoding channel that produced them is not identified in the shown evidence; confirm the decode source is the files' own docstring text and not a second hidden layer elsewhere in those files.

Do any VERL_-prefixed environment variables in this project conventionally carry secrets, which would determine the real impact of the check_environment-to-public-issue paste chain?

Credential access

The skill declares GitHub-issue authoring while every sampled unit is verl framework library code (platform detection, DataProto, dispatch decorators); no unit shown contains agent-facing instructions, so whether the agent ever executes any of this code is not established in this pass.

Which verl code consumes ModuleConfig.path/name to load, execute, or import the external module, and is the path restricted to trusted locations? The sink is not in this batch.

Code execution

The target skill declares GitHub issue creation, yet every unit in this batch is verl distributed-training framework source (worker management, RL config dataclasses, distillation losses); no sampled unit links the skill's issue workflow to this code, so no behavior chain across the two can be confirmed or excluded here.

The declared skill purpose is GitHub issue creation, but every owed unit is verl ML training internals (distillation/PPO loss math); no unit here issues commands, reads files, or touches the network, so no behavior chain exists in the shown content, but the issue-related skill content itself was not among the owed units and was not evaluated in this pass.

The skill is declared as 'Create or update a GitHub issue following verl project conventions' but this batch contains only verl ML-framework utility source (fs, hdfs_io, import_utils, megatron_utils, loggers); whether any skill instruction actually invokes this code, and why it is bundled, cannot be determined from the shown units.

The target is declared as a GitHub-issue skill (.agent/skills/issue), yet every owed unit is verl library source (torch/NPU memory profiler, python utils, QAT quantization); none of the shown units contains a network sink, credential access, persistence write, or downloaded-code execution, so no harmful source→sink chain is establishable from the evidence shown, but the units' connection to the skill's agent-facing behavior is not settled here.

The owed units are verl runtime ML utility modules (SGLang FP8/FP4 quantization refit, TensorDict manipulation, HuggingFace tokenizer/processor helpers, torch functional math) with no GitHub-issue functionality; whether the declared 'issue' skill ever executes or depends on these modules is not established by the evidence shown.

The target is declared as a skill for creating/updating GitHub issues in verl, yet every shipped unit is verl ML training/vLLM patch utility code; is this code actually consumed by the skill's behavior, or merely bundled repository context?

The target is declared as a skill named 'issue' for creating/updating GitHub issues, but every owed unit is verl RL-training-framework source (vLLM FP8/MXFP4 refit utilities and worker config dataclasses); whether these files are actually shipped under this skill root, and why, cannot be settled from the evidence shown (no behavior chain observed in any unit).

All 35 units are verl machine-learning framework configuration code (distillation, engine, model, optimizer, reward configs) with no network sends, credential access, persistence writes, or payload execution, yet the target skill declares a GitHub-issue authoring task; no unit shown links these files to any agent-executable behavior, and the agent-facing instruction file (if any) that connects them is not in this batch.

The declared skill description is about creating GitHub issues, but every analyzed unit is verl RL-training library code (vLLM rollout weight transfer, losses, padding); nothing shown ties these modules to the issue skill, so their reachability from the agent task is undetermined.

decode_delta_payload and _checkpoint_patch_api are defined in the un-shown head of delta_weight_transfer.py; whether the decoded delta payload is ever executed as code rather than applied only as weight tensors is not settleable from the shown units.

Code execution

VLLMHijack.hijack() is invoked in the worker constructor but the patched targets live in another module; what it patches and whether it alters safety-relevant behavior is not shown.

Tool poisoning

[file request scripts/diagnose.py] Does diagnose.py collect all environment variables (os.environ.items at line 172) and include them verbatim in its printed output, and does it redact secret-looking values (tokens, keys) before printing? The skill tells the agent to run this script and the issue template tells filers to paste its output into a public GitHub issue.

Credential access

[file request verl/utils/profiler/profile.py] Where and how is the configured finish_hook_cmd executed (direct subprocess/shell?), and is its value validated or restricted before execution?

Code execution

[file request verl/workers/rollout/vllm_rollout/utils.py] Where is VLLMHijack imported from and/or defined, and what does VLLMHijack.hijack() patch — does any of its patches disable checks, redirect network destinations, or condition other components' behavior?

Tool poisoning

[file request verl/utils/vllm/patch.py] What does VLLMHijack.hijack() patch in vLLM, and do any patches disable checks, redirect network destinations, or condition other components' behavior?

Tool poisoning

Refuted findings 25

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedmedium confidence

The issue skill instructs the agent to run python scripts/diagnose.py while composing bug reports, executing repository code beyond issue creation whose content is not shown in the reviewed material, leaving its env, file, and network behavior unverified.

.agent/skills/issue/SKILL.md:26-31

run `python scripts/diagnose.py` to gather system info if possible

Why it was refuted

The execution is explicitly declared in the skill body as the bug-report step (D1) and serves the declared issue-creation purpose, and the script's full content is shown in this batch, so the 'beyond issue creation / content unverified' premise fails.

Data exfiltration

criticalRefutedlow confidence

verl/utils/rollout_trace.py transmits function inputs and outputs, including rollout prompt and decoded response text, to user-configured external tracing backends (Weave, MLflow, Trackio), an undeclared data-egress capability for a skill whose declared purpose is creating GitHub issues; it is opt-in via backend configuration, so intent and reach are not established.

verl/utils/rollout_trace.py:385

call = tracer.create_call(op=func.__qualname__, inputs=inputs, attributes=cur_attributes)

Why it was refuted

All tracing egress is gated on an explicitly configured backend (None disables tracing entirely) and every destination is operator-chosen (Weave/Trackio init with operator project names; MLflow URI from the operator's own MLFLOW_TRACKING_URI), so there is no artifact-controlled recipient and the claimed exfiltration is intended, opt-in telemetry to the operator's own services.

Credential access

criticalRefutedmedium confidence

verl/utils/rollout_trace.py reads the MLFLOW_TRACKING_URI environment variable and points MLflow tracing at it, an undeclared environment read that the issue-creation skill's stated purpose does not require (residue R145, adjudicated unexplained; destination is user-supplied via env, so plausibly honest).

verl/utils/rollout_trace.py:99

MLFLOW_TRACKING_URI = os.environ.get(

Why it was refuted

The read supplies the operator's own MLFLOW_TRACKING_URI to mlflow.set_tracking_uri, i.e. local configuration of a user-chosen destination for the wrapped MLflow service; no credential is captured and nothing is sent to an artifact-chosen endpoint, so no harmful behavior exists.

Credential access

criticalRefutedlow confidence

verl/utils/tracking.py, a repository library module whose capabilities are undeclared by the issue skill's stated purpose of creating or updating GitHub issues, reads tracking-service credentials and endpoints from the environment (WANDB_ENTITY, MLFLOW_TRACKING_URI, MLFLOW_RUN_ID, SWANLAB_API_KEY, SWANLAB_LOG_DIR, SWANLAB_MODE, VOLC_ACCESS_KEY_ID, VOLC_SECRET_ACCESS_KEY, MLP_TRACKING_REGION) to authenticate opt-in logging backends; undeclared residue adjudicated as unexplained (visible, not concealed).

verl/utils/tracking.py:137

SWANLAB_API_KEY = os.environ.get(

Why it was refuted

Each listed value is read from the environment only to authenticate or configure the service it belongs to (e.g. SWANLAB_API_KEY is passed straight to swanlab.login, VOLC keys to volcengine_ml_platform.init), which is the wrapped-service env-key carve-out; nothing is transmitted to any artifact-chosen recipient.

Data exfiltration

criticalRefutedlow confidence

verl/utils/tracking.py's ValidationGenerationsLogger serializes validation samples (inputs, outputs, scores) to a temporary file and uploads it to the configured MLflow tracking server via mlflow.log_artifact, an undeclared data egress relative to the issue skill's stated purpose, adjudicated as unexplained since the destination is the user-configured MLFLOW_TRACKING_URI and nothing conceals it.

verl/utils/tracking.py:789-791

with open(validation_gen_step_file,

Why it was refuted

The upload runs only when the operator enabled the mlflow logging backend and the artifact goes to the operator-configured tracking server; logging validation samples to the user's own MLflow instance is the intended, opt-in telemetry function, not exfiltration to an unintended recipient.

Code execution

criticalRefutedmedium confidence

The verl NPU vLLM patch module (undeclared relative to the artifact's stated purpose of creating GitHub issues) reconstructs the installed vllm_ascend attention backend's source at runtime with textual replacements and executes it via exec() to monkey-patch AscendAttentionBackendImpl methods; the code is plainly visible and sourced only from the locally installed package, gated by NPU availability and a vLLM version range, so the dynamic-code-execution capability is real but its harm is not established.

verl/utils/vllm/npu_vllm_patch.py:373

exec(src, module_globals)

Why it was refuted

The exec'd source is reconstructed from the locally installed vllm_ascend package with unique-match assertions and skip-on-mismatch handling, gated on NPU availability and a vLLM version range, so it executes only code equivalent to importing the installed package and introduces no artifact-controlled or attacker-controlled input; the patch is fail-closed.

Code execution

criticalRefutedmedium confidence

Undeclared by the skill's stated purpose, the bundled verl model config automatically imports arbitrary user-specified external libraries during construction via import_external_libs(self.external_lib), a dynamic code-execution path not needed for GitHub-issue creation (adjudicated unexplained: plainly visible, not concealed).

verl/workers/config/model.py:147-148

import_external_libs(self.external_lib)

Why it was refuted

import_external_libs is invoked on the operator's own external_lib config field, which defaults to None, making this a standard plugin-import extension point whose trigger and source are the operator's explicit configuration, not artifact-initiated or concealed execution.

Code execution

criticalRefutedmedium confidence

Undeclared by the skill's stated purpose (create/update GitHub issues), the bundled verl optimizer builder executes importlib.import_module on the config-controlled optimizer_impl module path, a dynamic code-loading capability that issue creation does not need (residue R181, adjudicated unexplained: plainly visible, not concealed).

verl/workers/config/optimizer.py:339

module = importlib.import_module(config.optimizer_impl)

Why it was refuted

import_module resolves the operator-set optimizer_impl config value, whose documented values are installed packages such as torch.optim, torchao.optim, and bitsandbytes.optim; config-driven plugin loading at operator discretion is not artifact-initiated code execution and nothing conceals it.

Code execution

criticalRefutedlow confidence

Undeclared by the skill's stated purpose, the bundled rollout/reward configuration exposes multiple config-driven dynamic-import extension points (a custom backend module imported on every worker process, a custom AgentLoopManager class imported via importlib, a custom checkpoint manager class, and importlib-sourced reward managers) that are not needed for GitHub-issue creation (adjudicated unexplained: documented and visible, actual import sites are outside this batch).

verl/workers/config/rollout.py:79

This class will be dynamically imported via importlib. Only use trusted class paths.

Why it was refuted

These are operator-config extension points that default to None, the importlib behavior is openly disclosed in the config itself with a trusted-class-paths warning, and no actual import sink appears in the evidence; loading operator-specified plugins is the declared purpose of these fields, not concealed or artifact-initiated execution.

Data exfiltration

highRefutedmedium confidence

Undeclared by the skill description: the bug-report workflow instructs the agent to run scripts/diagnose.py, which contains a network-diagnostics capability that resolves DNS and fetches hardcoded pypi.python.org, pypi.douban.com, and Tsinghua mirror URLs via urlopen, though only when the non-default --network flag is set.

scripts/diagnose.py:38-39

URLS = {

Why it was refuted

The network code only times fixed public package-mirror URLs and discards the responses, is disabled by default (--network default=0), and the skill's instructed invocation passes no flags, so no local data reaches the network and no exfiltration chain exists.

Persistence

highRefutedlow confidence

The shipped verl filesystem helper _record_directory_structure writes a .directory_record.txt manifest into an arbitrary folder path via open(record_file, w), an undeclared host file-write capability not needed to create or update GitHub issues.

verl/utils/fs.py:166

with open(record_file,

Why it was refuted

The write is closed-loop cache bookkeeping, not a persistence vector: the only shipped caller passes the module's own HDFS-cache local_path, and the manifest is read back by _check_directory_structure to validate recopies, so the code does not do the claimed arbitrary host file-write/persistence harm.

Credential access

highRefutedlow confidence

The bundled logging setup (residue R99-R101, adjudicated unexplained) reads environment variable VERL_LOGGING_LEVEL and writes per-rank strings to a local logs/ file, undeclared but non-credential environment access and local log writes for an issue-authoring skill.

verl/utils/logging_utils.py:24

level = os.getenv(

Why it was refuted

Self-undermining as a credential finding: VERL_LOGGING_LEVEL only sets handler/logger verbosity and the file write appends rank-tagged log strings to logs/log_<rank> only when that directory already exists; the claim itself concedes the access is non-credential, so the CRED harm fails.

Credential access

highRefutedlow confidence

verl/utils/ray_utils.py binds the whole process environment (os.environ) as a default parameter to read Ray GPU-visibility flags, an undeclared environment-read capability that creating or updating a GitHub issue does not need (residue R144, adjudicated unexplained).

verl/utils/ray_utils.py:28

def ray_noset_visible_devices(env_vars=os.environ):

Why it was refuted

The os.environ binding only checks local Ray GPU-visibility flags and returns a boolean inside the process; no credential is read and no sink or agent instruction exists, so this is a broad-permission-only env read with no harmful behavior.

Destructive action

mediumRefutedlow confidence

scripts/migrate_megatron_checkpoint_layout.py migrate_one permanently deletes the user's original dist_ckpt directory with shutil.rmtree once --copy mode has made three copies, irreversibly destroying the original checkpoint layout if those copies are later found invalid.

scripts/migrate_megatron_checkpoint_layout.py:171

shutil.rmtree(legacy_dist)

Why it was refuted

The rmtree is the documented final step of an explicit copy-mode migration that runs only after the three independent copies are materialised (a dry_run mode also exists), and the skill never references this script, so this is guarded tool semantics rather than destructive behavior.

Code execution

mediumRefutedmedium confidence

The verl Megatron patch module performs an undeclared dynamic import probe of 'flash_attn.cute' and, when that import raises a non-ImportError, installs a meta-path finder that makes the module appear absent — an ML dependency workaround unrelated to the skill's declared GitHub-issue purpose, though documented, conditioned only on the module being genuinely broken, and not concealed (adjudicated unexplained).

verl/models/mcore/patch.py:134

importlib.import_module(

Why it was refuted

The probe-and-hide logic is a fully documented, narrowly conditioned compatibility workaround for a genuinely broken flash_attn.cute build that logs its action and executes no untrusted code, so the dynamic import is benign, not concealed execution.

Code execution

mediumRefutedmedium confidence

The verl Megatron patch module performs an undeclared dynamic import of the optional 'fast_hadamard_transform' package and registers a pure-torch stand-in module under the same name in sys.modules when the import fails — a training compatibility shim unrelated to the skill's declared GitHub-issue purpose, though fully documented in-line and not concealed (adjudicated unexplained).

verl/models/mcore/patch.py:71

importlib.import_module(

Why it was refuted

The dynamic import installs a documented, logged pure-torch stand-in only when the real CUDA-only package fails to import — a compatibility shim executing no untrusted code, so there is no harmful behavior to sustain the finding.

Credential access

mediumRefutedlow confidence

The verl utility module performs an undeclared read of the environment variable VERL_LOGGING_LEVEL via os.getenv to set its logger verbosity — an environment read unrelated to the skill's declared GitHub-issue purpose, though the variable configures logging only and is not a credential (adjudicated unexplained).

verl/models/mcore/util.py:30

logger.setLevel(os.getenv(

Why it was refuted

The read only selects the module's own logging verbosity — in-process logging configuration, not credential access — so the CRED claim describes no harmful behavior.

Credential access

mediumRefutedlow confidence

Adjudicated unexplained (residue R44-R49): the verl Worker initialization shipped with this artifact reads the distributed-training coordination variables WORLD_SIZE, RANK, MASTER_ADDR, MASTER_PORT, LOCAL_WORLD_SIZE and LOCAL_RANK, an undeclared capability the issue-creation skill's purpose does not need; nothing conceals it and the values are training-topology settings rather than credentials.

verl/single_controller/base/worker.py:194

world_size = int(os.environ[

Why it was refuted

The variables populate the worker's own distributed-topology configuration (world size, rank, master address/port) — training settings, not credentials — so the CRED claim identifies no harmful behavior.

Credential access

mediumRefutedlow confidence

Adjudicated unexplained (residue R50-R60): the verl device-setup code shipped with this artifact reads and rewrites GPU-visibility variables (ROCR/HIP/CUDA_VISIBLE_DEVICES), writes LOCAL_RANK and REDIS_STORE_SERVER_HOST into its own process environment, and dynamically reads the visible-devices key, undeclared capabilities the GitHub-issue skill's purpose does not need; they are unhidden in-process environment configuration, not persistence, credential theft, or exfiltration.

verl/single_controller/base/worker.py:253

os.environ[

Why it was refuted

The code only normalizes GPU-visibility and rank variables inside its own process environment — device configuration for distributed training, not persistence, credential theft, or exfiltration.

Credential access

mediumRefutedlow confidence

Adjudicated unexplained (residue R42/R43): the verl library code shipped with this artifact reads the WG_BACKEND environment variable and binds a local socket to find a free master port, capabilities the declared purpose of creating GitHub issues does not require; they are undeclared but unhidden, and the socket is a local ephemeral-port bind rather than remote transmission or credential access.

verl/single_controller/base/worker.py:53

if os.getenv(

Why it was refuted

WG_BACKEND only selects the ray helper and the socket is a transient local bind to find a free master port — no remote transmission and no credential access — so the flagged behavior is benign coordination.

Code execution

mediumRefutedlow confidence

verl trainer config defines ModuleConfig, a schema whose path field selects an external Python module that the framework can load, execute, and import, enabling arbitrary code execution if the configured path is attacker-controlled; the loading call site is not present in this batch.

verl/trainer/config/config.py:114

Configuration for external Python module, which can be loaded, executed (and optionally, ``import``ed).

Why it was refuted

ModuleConfig is an inert two-field dataclass documenting an opt-in plugin path; nothing in the shipped code shown loads or executes it, so no execution behavior or chain exists in the artifact to sustain the finding.

Persistence

mediumRefutedlow confidence

The shipped verl filesystem helper copy_to_shm writes caller-supplied files and directory trees into /dev/shm/verl-cache/ via os.makedirs and shutil copy calls, an undeclared host file-write capability not needed to create or update GitHub issues.

verl/utils/fs.py:145-160

shm_model_root =

Why it was refuted

copy_to_shm fills a volatile tmpfs cache to speed repeated model loads — contents vanish on reboot and nothing auto-runs — so it is a performance cache, not a persistence mechanism.

Reconnaissance

lowRefutedlow confidence

The shipped verl groupwise helper _resolve_device reads the VERL_FORCE_DEVICE and PYTEST_CURRENT_TEST environment variables to select a torch device, environment inspection undeclared by the skill's stated purpose of creating or updating GitHub issues.

verl/utils/groupwise.py:66-71

forced = os.getenv(

Why it was refuted

These are open device-selection plumbing reads the module docstring itself declares as an override policy, and the values' only sink is torch.device construction or CPU selection under pytest, so no reconnaissance mechanism exists to support the RECON harm.

Reconnaissance

lowRefutedlow confidence

The shipped verl HDFS IO module reads the VERL_SFT_LOGGING_LEVEL environment variable at import time to configure its logger, environment inspection undeclared by the skill's stated purpose of creating or updating GitHub issues.

verl/utils/hdfs_io.py:20

logger.setLevel(os.getenv(

Why it was refuted

The import-time env read's only sink is logger.setLevel, configuring verbosity from VERL_SFT_LOGGING_LEVEL with a WARN default; nothing is collected, stored, or reported, so the claimed reconnaissance mechanism does not exist.

Reconnaissance

infoRefutedlow confidence

The shipped verl device utility get_npu_versions reads the ASCEND_VISIBLE_DEVICES and ASCEND_HOME_PATH environment variables and probes npu-smi output and the CANN install info file, which is host and environment inspection undeclared by the skill's stated purpose of creating or updating GitHub issues.

verl/utils/device.py:229-284

visible_devices = os.environ.get(

Why it was refuted

get_npu_versions is local hardware/software version detection used to gate IPC support; it inspects the local NPU and install files and transmits nothing, so it is benign capability detection rather than hostile reconnaissance.

Coverage gaps 36

Parts of the artifact the static analysis could not fully examine.

context:submodule_present submodules are not fetched

.gitmodules

no_dataflow_for_dynamic_code line 71: invoked code is not structurally extracted

verl/models/mcore/patch.py

no_dataflow_for_dynamic_code line 134: invoked code is not structurally extracted

verl/models/mcore/patch.py

no_dataflow_for_dynamic_code line 88: invoked code is not structurally extracted

verl/utils/import_utils.py

no_dataflow_for_dynamic_code line 172: invoked code is not structurally extracted

verl/utils/import_utils.py

no_dataflow_for_dynamic_code line 289: invoked code is not structurally extracted

verl/utils/import_utils.py

no_dataflow_for_dynamic_code line 250: invoked code is not structurally extracted

verl/utils/py_functional.py

no_dataflow_for_dynamic_code line 275: invoked code is not structurally extracted

verl/utils/py_functional.py

no_dataflow_for_dynamic_code line 373: invoked code is not structurally extracted

verl/utils/vllm/npu_vllm_patch.py

no_dataflow_for_dynamic_code line 339: invoked code is not structurally extracted

verl/workers/config/optimizer.py

no_dataflow_for_dynamic_code line 91: invoked code is not structurally extracted

verl/workers/rollout/vllm_rollout/utils.py

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:7658d9259a6b6c41

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:8c1b458d3120f047

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:83c4ac63ee829ae6

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:c485d4195b75ec78

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:eb2e21b98a5ae2aa

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:c3c92615c08c7e1c

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:ef10f44ae61fc059

ledger_finding_without_valid_finding run 1: declared-vs-actual.2 SRC:e84c02bc39bf2903

ledger_finding_without_valid_finding run 1: declared-vs-actual.10 SRC:ae0540813f2bfd57

ledger_finding_without_valid_finding run 1: behavior-chains.7 SRC:70780dc96256ffdf

ledger_finding_without_valid_finding run 1: behavior-chains.7 SRC:d7fb3dfa7c5426a5

ledger_finding_without_valid_finding run 1: behavior-chains.7 SRC:59f62bb97a44be85

ledger_finding_without_valid_finding run 1: behavior-chains.7 SRC:8fa6bc8564aa1654

ledger_finding_without_valid_finding run 1: behavior-chains.7 SRC:f20029154f89e54a

ledger_finding_without_valid_finding run 1: behavior-chains.9 SRC:ae0540813f2bfd57

ledger_finding_without_valid_finding run 1: behavior-chains.9 SRC:9f9e8614a17e97b3

invalid_judge_finding declared-vs-actual.2

invalid_judge_finding declared-vs-actual.10

invalid_judge_finding behavior-chains.7

invalid_judge_finding behavior-chains.9

request_unanswered request.0: instruction-surface.0/req-diagnose-env: finding: no valid finding cites the answer's evidence

invalid_judge_finding request.0

request_unanswered request.1: declared-vs-actual.9/req-finish-hook-01: finding: no valid finding cites the answer's evidence

invalid_judge_finding request.1

invalid_judge_finding request.4