hugging-face-model-trainer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow can ingest outsider-authored free text from the user-specified Hugging Face dataset via datasets.load_dataset(...) (e.g., scripts/train_sft_example.py / train_dpo_example.py / train_grpo_example.py), which then becomes LLM-readable training text in the job’s context; additionally, the optional dataset_inspector.py fetches and prints dataset rows (including example field contents) to stdout, which the agent may read/parse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly instructs fetching and executing remote scripts during job runtime — e.g., running the dataset inspector at https://huggingface.co/datasets/mcp-tools/skills/raw/main/dataset_inspector.py, loading TRL example scripts from GitHub/raw URLs (e.g. https://raw.githubusercontent.com/huggingface/trl/main/trl/scripts/grpo.py), and the GGUF converter cloning/executing code from https://github.com/ggerganov/llama.cpp.git — all of which are runtime-fetched code that will be executed inside jobs.