tao-run-inference-service

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly resolves and pulls container images as concrete nvcr.io/... image URIs at runtime (Section 2 / job_payload_builder → "Resolve it to a concrete nvcr.io/... image URI") and also allows hf_model:/// HuggingFace Hub model paths that the running container may fetch using HF_TOKEN; both nvcr.io (container image pulls) and HuggingFace Hub (hf_model:// / huggingface.co) are runtime external dependencies that result in executing remote code/artifacts.