The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/download_weights.py uses the subprocess module to execute hf (huggingface-cli) and modelscope commands. While it uses argument lists which prevents shell injection, it still grants the agent the ability to invoke these external binaries on the host system.
[DYNAMIC_EXECUTION]: In scripts/generate_fake_weights.py, the transformers.AutoConfig.from_pretrained function is called with trust_remote_code=True. This allows the library to execute Python code defined in the model's configuration directory if the model uses a custom architecture. If a user points the skill at a malicious repository, this could lead to arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect injection as it ingests data (model configurations, metadata) from external sources like HuggingFace and ModelScope.
Ingestion points: model_id provided via CLI arguments; model_index.json and config.json downloaded from remote repositories.
Boundary markers: None identified; external content is processed directly.
Capability inventory: File system writes via save_pretrained and shutil.copy; command execution via subprocess.run in download_weights.py.
Sanitization: There is no validation or sanitization of the downloaded metadata before it is used to instantiate model components.

diffusers-ascend-weight-prep