# training-data-poisoning

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects training and fine-tuning pipelines that ingest external data without integrity gating. Use when writing fine-tuning pipelines, dataset ingestion scripts, external training data loaders, or code that collects and processes data for model training. Also invoke when automating dataset curation from web scraping or user-contributed sources.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/training-data-poisoning ~/.claude/skills/training-data-poisoning
```

## From README

Training Data Poisoning Security Check (OWASP LLM03:2025) What this checks Protects against malicious or low-quality examples being introduced into training or fine-tuning datasets. Poisoned data can embed backdoors, degrade accuracy, or skew model behavior in ways that are difficult to detect after training completes. Vulnerable patterns Ingesting scraped or user-contributed examples with no content validation No deduplication or anomaly detection on training set statistics Loading dataset files without verifying provenance or checksums Using the same split for training and validation, hiding distribution shift Fix immediately Flag the vulnerable code, explain the risk, and suggest a fix establishing these properties. Translate to the data-loading and validation libraries of the audited file — use that stack's documented hashing, schema, and dataframe APIs; do not import a recipe from a different stack. Every external dataset file is checksum-verified before use.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/training-data-poisoning/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars