The Agent Skills Directory

[COMMAND_EXECUTION]: The script tune_qwen3_1.7b_bayesian.py is vulnerable to shell command injection. It constructs a shell command string using f-string interpolation of the dataset parameter—which is a user-controllable command-line option—and executes it via subprocess.run(..., shell=True). An attacker could exploit this by providing a malicious dataset name (e.g., horus; touch /tmp/pwned) to execute arbitrary code on the host system. While a 'fixed' version of this script exists in the skill, the vulnerable script remains part of the package and could be accidentally or maliciously invoked.
[EXTERNAL_DOWNLOADS]: The skill automatically downloads third-party code and model weights from GitHub (github.com/QwenLM/Qwen3-TTS), HuggingFace, and ModelScope. Additionally, the skill's transcription pipeline pulls and runs a Docker image from an unverified personal repository on GitHub Container Registry (ghcr.io/jim60105/whisperx), which increases the risk of supply-chain attacks.
[REMOTE_CODE_EXECUTION]: The skill implements a workflow that clones a remote repository and applies a local patch file (001-fix-sft-optimizations.patch) at runtime. This dynamic modification and execution of external code circumvent static verification of the model's behavior. The skill also relies heavily on Docker for execution of complex audio processing logic from remote sources.
[DATA_EXFILTRATION]: The inference and tokenization logic in qwen_tts/inference/qwen3_tts_model.py and qwen3_tts_tokenizer.py utilizes urllib.request.urlopen to download audio files from user-supplied URLs. This creates a Server-Side Request Forgery (SSRF) vulnerability where an attacker could induce the agent to probe internal network services, access restricted local metadata endpoints, or leak internal information via request parameters.

tts-train