import-model
Warn
Audited by Snyk on Jun 13, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The repo's scripts fetch Hugging Face model repos at runtime (e.g. https://huggingface.co/<HF_MODEL_ID>/raw/main/config.json and related safetensors/model files) and call transformers.from_pretrained(..., trust_remote_code=True) which downloads and can execute remote model code from the HF repo, meaning external content is fetched at runtime, may execute code that controls model behavior, and is required for the skill.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata