Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Train language models using TRL (Transformer Reinforcement Learning) on fully managed Hugging Face infrastructure. No local GPU setup required — models train on cloud GPUs and results are automatically saved to the Hugging Face Hub.
TRL provides multiple training methods:
See references/training_methods.md for method overviews and selection guidance.
Use Unsloth (references/unsloth.md) instead of standard TRL when GPU memory is limited (~60% less VRAM), speed matters (~2x faster), training large models (>13B), or training Vision-Language Models (Unsloth has FastVisionModel support). See scripts/unsloth_sft_example.py for a production-ready training script.
hf jobs uv run (CLI) or the hf_jobs() MCP tool if the Hugging Face MCP server is configured — pass the training script inline, don't save to a local file unless the user explicitly requests it. If the user asks to "train a model" or "fine-tune", create the training script AND submit the job immediately.scripts/ templates.scripts/train_sft_example.py, scripts/train_dpo_example.py, etc.Repository scripts use PEP 723 inline dependencies. Run them with uv run:
uv run scripts/estimate_cost.py --help
uv run scripts/dataset_inspector.py --help
Account & Authentication:
secrets={"HF_TOKEN": "$HF_TOKEN"} in the job config.Dataset Requirements:
datasets.load_dataset().Critical Settings:
push_to_hub=True, hub_model_id="username/model-name", secrets={"HF_TOKEN": "$HF_TOKEN"}.Training jobs run in the background and can take hours. After submitting: report the job ID, monitoring URL, and estimated time; wait for the user to request status checks rather than polling. Initial logs can take 30-60 seconds to appear.
Sequence length: TRL config classes use max_length (not max_seq_length). Default is max_length=1024 (truncates from right) — override higher for longer context, lower under memory constraints, or None for vision models (to avoid cutting image tokens).
UV scripts use PEP 723 inline dependencies for clean, self-contained training:
hf_jobs("uv", {
"script": """
# /// script
# dependencies = ["trl>=0.12.0", "peft>=0.7.0", "trackio"]
# ///
from datasets import load_dataset
from peft import LoraConfig
from trl import SFTTrainer, SFTConfig
import trackio
dataset = load_dataset("trl-lib/Capybara", split="train")
dataset_split = dataset.train_test_split(test_size=0.1, seed=42)
trainer = SFTTrainer(
model="Qwen/Qwen2.5-0.5B",
train_dataset=dataset_split["train"],
eval_dataset=dataset_split["test"],
peft_config=LoraConfig(r=16, lora_alpha=32),
args=SFTConfig(
output_dir="my-model", push_to_hub=True, hub_model_id="username/my-model",
num_train_epochs=3, eval_strategy="steps", eval_steps=50,
report_to="trackio", project="my_project", run_name="my_run",
),
)
trainer.train()
trainer.push_to_hub()
""",
"flavor": "a10g-large",
"timeout": "2h",
"secrets": {"HF_TOKEN": "$HF_TOKEN"},
})
The script parameter accepts inline code or a publicly-accessible/Hub/GitHub/Gist URL — local file paths do not work (jobs run in isolated containers with no access to the local filesystem). To use a local script, upload it to the Hub first (hf upload ...) and reference its resolved URL.
Run TRL's battle-tested example scripts directly from a URL, passing CLI-style script_args (--model_name_or_path, --dataset_name, --output_dir, --push_to_hub, --hub_model_id). Available at https://github.com/huggingface/trl/tree/main/examples/scripts.
When no hf_jobs-style tool is available, use the hf jobs CLI directly. Flags must come before the script URL, the subcommand order is hf jobs uv run (not run uv), and use --secrets (plural):
hf jobs uv run \
--flavor a10g-large --timeout 2h --secrets HF_TOKEN \
"https://huggingface.co/user/repo/resolve/main/train.py"
Check status: hf jobs ps, hf jobs logs <job-id>, hf jobs inspect <job-id>, hf jobs cancel <job-id>.
uvx trl-jobs sft --model_name Qwen/Qwen2.5-0.5B --dataset_name trl-lib/Capybara gives pre-configured defaults, automatic Trackio integration, and automatic Hub push — best for terminal-only, quick local experimentation. Repository: https://github.com/huggingface/trl-jobs.
| Model Size | Recommended Hardware | Cost (approx/hr) |
|---|---|---|
| <1B params | t4-small | ~$0.75 |
| 1-3B params | t4-medium, l4x1 | ~$1.50-2.50 |
| 3-7B params | a10g-small, a10g-large | ~$3.50-5.00 |
| 7-13B params | a10g-large, a100-large (LoRA) | ~$5-10 |
| 13B+ params | a100-large, a10g-largex2 (LoRA) | ~$10-20 |
Use LoRA/PEFT for models >7B; multi-GPU is handled automatically by TRL/Accelerate. See references/hardware_guide.md for full specs.
The Jobs environment is ephemeral — everything is deleted when the job ends. Set push_to_hub=True and hub_model_id="username/model-name" in the training config, and pass secrets={"HF_TOKEN": "$HF_TOKEN"} in the job submission. See references/hub_saving.md for troubleshooting.
Default is 30 minutes — too short for real training. Set explicitly ("timeout": "2h", formats: "90m", "2h", seconds as integer) with a 20-30% buffer for loading/checkpointing/Hub push. Guideline: quick demo 10-30min, development 1-2h, production (3-7B) 4-6h. On timeout the job is killed immediately and unsaved progress is lost.
Use scripts/hf_benchmarks.py to find top-performing models for a task, keeping size/hardware constraints in mind: uv run scripts/hf_benchmarks.py search --query ocr then uv run scripts/hf_benchmarks.py leaderboard <benchmark-id>.
Offer to estimate cost when parameters are known (hardware, dataset size, epochs), with scripts/estimate_cost.py:
uv run scripts/estimate_cost.py --model meta-llama/Llama-2-7b-hf --dataset trl-lib/Capybara --hardware a10g-large --dataset-size 16000 --epochs 3
Production-ready templates: scripts/train_sft_example.py, scripts/train_dpo_example.py, scripts/train_grpo_example.py, scripts/unsloth_sft_example.py (Unsloth, faster/less VRAM). Pass their content inline or use as templates.
Add trackio to dependencies and configure report_to="trackio", run_name="meaningful_name". Defaults: space ID {username}/trackio, minimal config (hyperparameters + model/dataset info), a Project Name to group runs. Apply the user's preferences instead when specified. See references/trackio_guide.md for grouping runs across experiments.
Validate BEFORE launching GPU training — 50%+ of training failures are format mismatches, and DPO is especially strict about column names (prompt, chosen, rejected). Validation on CPU costs ~$0.01 and takes <1 minute vs. wasting $1-10 and 30-60 minutes on a failed GPU job.
Always validate unknown/custom datasets and any DPO dataset; skip validation only for well-known TRL datasets (trl-lib/ultrachat_200k, trl-lib/Capybara, etc.). Use the Hub-hosted dataset inspector script (--dataset name --split train); output markers are ✓ READY, ✗ NEEDS MAPPING (includes copy-paste mapping code), or ✗ INCOMPATIBLE.
Convert trained models to GGUF for llama.cpp/Ollama/LM Studio/local inference — supports 4/5/8-bit quantization, typically 2-8GB for 7B models vs. 14GB unquantized. See references/gguf_conversion.md for the complete conversion script, quantization options, and troubleshooting.
See references/training_patterns.md: quick demo, production with checkpoints, multi-GPU, DPO, GRPO.
per_device_train_batch_size (increase gradient_accumulation_steps to compensate, target effective batch size ~128), enable gradient_checkpointing=True, or upgrade hardware.num_train_epochs/dataset size; save checkpoints (save_strategy="steps", hub_strategy="every_save") so partial progress survives.secrets={"HF_TOKEN": "$HF_TOKEN"}, push_to_hub=True, hub_model_id, write permissions, and that the target repo exists (or hub_private_repo=True).See references/troubleshooting.md for the complete guide.
References: references/training_methods.md, training_patterns.md, unsloth.md, gguf_conversion.md, trackio_guide.md, hardware_guide.md, hub_saving.md, troubleshooting.md, local_training_macos.md.
Scripts: scripts/train_sft_example.py, train_dpo_example.py, train_grpo_example.py, unsloth_sft_example.py, estimate_cost.py, convert_to_gguf.py, hf_benchmarks.py.
External: TRL docs, TRL Jobs training guide, TRL Jobs package, HF Jobs docs, UV scripts guide.
hf jobs CLI (Approach 3) when no job-submission tool is available.まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate project context. Use when the user asks to check, audit, review, update, improve, or fix their AGENTS.md or CLAUDE.md, mentions "project rules maintenance" or "agent context optimization", or when the codebase has changed enough that the rules file may be stale. Scans the repository for every rules file, grades each against a quality rubric, outputs a quality report, and applies targeted edits only after user approval.
日本語の概要は準備中です。原文の説明を表示しています。
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future sessions benefit. Use when the user says "revise the rules", "update AGENTS.md / CLAUDE.md with what we just learned", "save this to project memory", "remember this for next time", or at the end of a productive session when valuable context has emerged that is not yet documented. This complements agents-md-improver — improver audits, while this one captures.
日本語の概要は準備中です。原文の説明を表示しています。
Operational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair actions for interface design. Use as the reference rubric when building or reviewing marketing sites, product interfaces, dashboards, portfolios, or e-commerce pages, especially alongside frontend-design.
日本語の概要は準備中です。原文の説明を表示しています。
Design a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive implementation blueprint with specific files to create or modify, component designs, data flows, and a build sequence. Use this skill when the user asks for an architecture design, an implementation plan for a non-trivial feature, or when dispatched as a sub-task during feature-dev architecture phase.
日本語の概要は準備中です。原文の説明を表示しています。
Deeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and abstractions, and documenting dependencies. Use this skill when you need to understand how a feature works before modifying or extending it, when dispatched as a sub-task during feature-dev exploration, or when the user asks "how does X work in this codebase".
日本語の概要は準備中です。原文の説明を表示しています。