local-knowledge

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code enables execution of remote model-provided code (trust_remote_code=True) and automatically bootstraps/installs packages/models, creating a high risk of remote code execution / supply-chain abuse if untrusted models or package sources are used.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The multimodal backend sets trust_remote_code=True when constructing a SentenceTransformer and will fetch model repositories at runtime (e.g., the default multimodal model "Qwen/Qwen3-VL-Embedding-2B"), which can download and execute remote model code and thus allow external repos to control runtime behavior.