alterlab-timesfm

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md explicitly states that TimesFM weights are downloaded on-demand from the public Hugging Face hub (e.g., via from_pretrained / "google/timesfm-2.5-200m-pytorch" and cached in ~/.cache/huggingface/), so it fetches and loads third-party model artifacts from an open public source which directly affect inference outputs and downstream decisions.