compare-models
Warn
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically generates Python code for execution via the
python -cshell command. It uses string interpolation to insert user-provided variables—including<MODEL_PATH>,<DATA_YAML>, and<IMGSZ>—directly into the script. This creates a code injection vulnerability where a maliciously crafted input (e.g., a file path containing single quotes and Python code) could execute arbitrary commands in the environment. - [COMMAND_EXECUTION]: Although the skill specifies a pre-check to verify file existence, this is an insufficient security control against injection. An attacker could create a file with a name that is both valid on the filesystem and serves as an injection payload (e.g.,
'';import os;os.system("id");#). - [COMMAND_EXECUTION]: The skill uses
yaml.safe_load()to process configuration files (yolo-project.yamlanddata.yaml), which is a recommended security practice that prevents arbitrary code execution during the YAML parsing phase.
Audit Metadata