speculative-decoding
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download source code from external, third-party GitHub repositories that are not included in the pre-defined trusted organizations list:
https://github.com/FasterDecoding/Medusa(referenced inSKILL.mdandreferences/medusa.md)https://github.com/hao-ai-lab/LookaheadDecoding(referenced inSKILL.mdandreferences/lookahead.md)- [REMOTE_CODE_EXECUTION]: The documentation provides installation commands that clone these external repositories and immediately install them in editable mode (
pip install -e .). This process executes build scripts (e.g.,setup.py) from the downloaded source, which can lead to arbitrary code execution if the external repositories were compromised. - [COMMAND_EXECUTION]: The skill includes multiple shell command blocks for environment setup and software installation, involving
git clone,cd, andpip installoperations targeting external codebases.
Audit Metadata