modelscope-cli

Warn

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The scripts/setup_proxy.sh script modifies the user's ~/.bashrc file to persist proxy environment variables (HTTP_PROXY, HTTPS_PROXY, etc.) across shell sessions. While intended for configuration management, modifying shell initialization files is a recognized persistence mechanism.
  • [COMMAND_EXECUTION]: Both scripts/run_ms_model_download.sh and scripts/run_ms_datasets_download.sh use the eval command to execute dynamically constructed shell strings. This pattern is used to run the modelscope download command with variable arguments such as model IDs and local directories.
  • [COMMAND_EXECUTION]: The scripts/run_network_diagnose.sh and scripts/run_preflight_check.sh scripts utilize curl -k (or --insecure), which bypasses SSL certificate verification when testing connectivity to ModelScope endpoints.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to download large-scale data and code (models and datasets) from modelscope.cn, a well-known machine learning platform. It also configures pip to use official third-party mirrors from Tsinghua University and Alibaba for package installation.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for the agent to ingest external, untrusted content from the ModelScope repository into the local execution environment.
  • Ingestion points: Data is fetched via modelscope download commands in scripts/run_ms_model_download.sh and scripts/run_ms_datasets_download.sh.
  • Boundary markers: None identified; downloaded content is not isolated from subsequent agent context.
  • Capability inventory: The skill possesses capabilities for filesystem writes (mkdir), integrity checking (sha256sum), and network operations (curl, ping, nc).
  • Sanitization: None identified; the skill performs integrity verification (SHA256) but does not sanitize the contents of the downloaded models or datasets before the agent interacts with them.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 20, 2026, 01:45 PM