huggingface-local-models

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow fetches Hugging Face model pages and the ?local-app=llama.cpp page (public web content) and reads their text/HTML to extract quant recommendations, which is outsider-authored free text that can include prompt-injection payloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches and relies on Hugging Face URLs at runtime (e.g. https://huggingface.co/?local-app=llama.cpp and https://huggingface.co/api/models//tree/main?recursive=true) to extract quant labels and GGUF filenames which are then loaded/executed by llama-cli/llama-server, and it also shows installing/building remote code via git clone https://github.com/ggml-org/llama.cpp (remote code fetched and built), so external content both controls runtime instructions and is executed locally.