import-model
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/test_scripts.pyscript utilizessubprocess.runto execute other Python scripts located within the skill'sscripts/directory. This is used for automated smoke-testing of the utility scripts and does not involve untrusted input.\n- [DYNAMIC_EXECUTION]: The skill uses theimportlibandastlibraries inscripts/inspect_hf.pyandscripts/scaffold.pyto introspect modeling code from thetransformerslibrary and analyze donor architectures. This dynamic behavior is used for codebase discovery and automated scaffolding.\n- [EXTERNAL_DOWNLOADS]: The utility scripts make network connections to the Hugging Face Hub (huggingface.co) to download model configuration files (config.json) and metadata. These operations target well-known repositories as part of the model import process.\n- [REMOTE_CODE_EXECUTION]: The instructions and scripts utilize thetrust_remote_code=Trueparameter when interacting with the Hugging Facetransformerslibrary. This is a standard mechanism for loading custom model architectures not natively supported by the library; however, it permits the execution of code defined in the remote model repository. The skill explicitly identifies this as a requirement for certain models and provides pre-flight checks.
Audit Metadata