·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 8.
2
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/logging_metrics.md | Malicious Code & Command Execution | — | Low | Open | |
references/logging_metrics.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open |
2 findings
Trackio is an experiment tracking library for logging and visualizing ML training metrics. It syncs to Hugging Face Spaces for real-time monitoring dashboards.
| Task | Interface | Reference |
|---|---|---|
Logging metrics during training | Python API | |
Firing alerts for training diagnostics | Python API | |
Retrieving metrics & alerts after/during training | CLI |
Use import trackio in your training scripts to log metrics:
trackio.init()trackio.log() or use TRL's report_to="trackio"trackio.finish()Key concept: For remote/cloud training, pass space_id — metrics sync to a Space dashboard so they persist after the instance terminates. Auto-created Spaces are public by default — pass private=True if the metrics should not be public.
→ See references/logging_metrics.md for setup, TRL integration, and configuration options.
Insert trackio.alert() calls in training code to flag important events — like inserting print statements for debugging, but structured and queryable:
trackio.alert(title="...", level=trackio.AlertLevel.WARN) — fire an alertINFO, WARN, ERRORKey concept for LLM agents: Alerts are the primary mechanism for autonomous experiment iteration. An agent should insert alerts into training code for diagnostic conditions (loss spikes, NaN gradients, low accuracy, training stalls). Since alerts are printed to the terminal, an agent that is watching the training script's output will see them automatically. For background or detached runs, the agent can poll via CLI instead.
→ See references/alerts.md for the full alerts API, webhook setup, and autonomous agent workflows.
Use the trackio command to query logged metrics and alerts:
trackio list projects/runs/metrics — discover what's availabletrackio get project/run/metric — retrieve summaries and valuestrackio list alerts --project <name> --json — retrieve alertstrackio show — launch the dashboardtrackio sync — sync to HF SpaceKey concept: Add --json for programmatic output suitable for automation and LLM agents.
→ See references/retrieving_metrics.md for all commands, workflows, and JSON output formats.
When running experiments autonomously as an LLM agent, the recommended workflow is:
trackio.alert() calls for diagnostic conditionstrackio list alerts --project <name> --json --since <timestamp> to check for new alertstrackio get metric ... to inspect specific valuesThen poll from a separate terminal/process:
Get started with chainctlchainctl skill install public/huggingface/huggingface-trackio:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/huggingface/skills/huggingface-trackio:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
references/alerts.md
references/logging_metrics.md
references/retrieving_metrics.md