faiss
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill demonstrates storing and retrieving metadata using Python's
picklemodule, which is inherently insecure. - File: SKILL.md
- Evidence:
metadata = pickle.load(f) - Context: The instructions suggest loading a metadata file (
metadata.pkl) which, if replaced with a malicious payload, allows for arbitrary code execution on the user's system. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing third-party dependencies from standard package registries.
- File: SKILL.md
- Evidence:
pip install faiss-cpu,pip install faiss-gpu,pip install sentence-transformers numpy - Context: These are well-known libraries in the machine learning ecosystem and are considered safe to install through official channels.
Audit Metadata