nano-world-model
Warn
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a pre-trained model file (
i3d_torchscript.pt) from a Dropbox URL usingcurl. It also provides code to download model checkpoints (checkpoint.ckpt) from HuggingFace repositories under the user accountknightnemo. - [REMOTE_CODE_EXECUTION]: The skill provides Python examples for loading the downloaded checkpoint files using
torch.load(). PyTorch checkpoints and TorchScript models are often stored using the Pythonpicklemodule, which is known to be unsafe for loading data from untrusted or external sources as it can lead to arbitrary code execution if the files contain malicious payloads. - [COMMAND_EXECUTION]: The installation process involves cloning a repository from GitHub and creating a Conda environment, which involves executing multiple shell commands and scripts from an external repository.
Audit Metadata