atc-model-converter

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/export_onnx.py

The code is a model conversion utility with no clear malicious behavior. The significant security risk is unsafe deserialization of a user-supplied model through torch.load(..., weights_only=False), which can execute arbitrary code if the model file is malicious. Only trusted model files should be accepted, or safer weights-only loading and explicit model reconstruction should be used. The undefined epilog variable is a separate execution bug.

Confidence: 98%Severity: 62%
Audit Metadata
Analyzed At
Sep 20, 2026, 01:45 PM
Package URL
pkg:socket/skills-sh/ascend%2Fagent-skills%2Fatc-model-converter%2F@acec3f262f284ec741ef0cfa87b9cdcce6930495bae51dbccac35acfeaf3dcbe