hugging-face-jobs

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit examples that pass remote script URLs or container images to hf_jobs (e.g., https://huggingface.co/datasets/uv-scripts/synthetic-data/raw/main/cot-self-instruct.py, https://raw.githubusercontent.com/huggingface/trl/main/trl/scripts/sft.py, ghcr.io/astral-sh/uv:python3.12-bookworm-slim) which are fetched at runtime and executed in the remote job environment, so these are runtime external dependencies that execute remote code.