skills/modular/skills/import-model/Gen Agent Trust Hub

import-model

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/test_scripts.py script utilizes subprocess.run to execute other Python scripts located within the skill's scripts/ directory. This is used for automated smoke-testing of the utility scripts and does not involve untrusted input.\n- [DYNAMIC_EXECUTION]: The skill uses the importlib and ast libraries in scripts/inspect_hf.py and scripts/scaffold.py to introspect modeling code from the transformers library and analyze donor architectures. This dynamic behavior is used for codebase discovery and automated scaffolding.\n- [EXTERNAL_DOWNLOADS]: The utility scripts make network connections to the Hugging Face Hub (huggingface.co) to download model configuration files (config.json) and metadata. These operations target well-known repositories as part of the model import process.\n- [REMOTE_CODE_EXECUTION]: The instructions and scripts utilize the trust_remote_code=True parameter when interacting with the Hugging Face transformers library. This is a standard mechanism for loading custom model architectures not natively supported by the library; however, it permits the execution of code defined in the remote model repository. The skill explicitly identifies this as a requirement for certain models and provides pre-flight checks.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 07:06 PM
Security Audit — agent-trust-hub — import-model