explain
Warn
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script 'scripts/shap_explain.py' uses 'joblib.load()' and 'torch.load()' to deserialize model files. These functions are backed by the 'pickle' module, which is inherently insecure and can be exploited to execute arbitrary code when loading a crafted malicious file.\n- [COMMAND_EXECUTION]: The skill uses 'uv run' to execute a Python script that performs the unsafe loading of model files from paths provided as command-line arguments.
Audit Metadata