The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/benchmark_model.py script leverages the Hugging Face transformers library to load model configurations and architectures. It exposes the trust_remote_code flag, which allows the execution of arbitrary Python code from within a model's repository. The skill mitigates this risk by explicitly instructing the agent not to enable this flag without user approval and recommending the use of specific commit revisions to ensure supply chain security.
[COMMAND_EXECUTION]: The scripts/benchmark_via_builtin.py script uses the subprocess module to execute system commands, such as running the FlashInfer benchmark driver and querying repository metadata via git. These executions are performed using list-based arguments rather than shell strings, which prevents shell injection vulnerabilities. These operations are restricted to the local environment and user-specified directories as required for benchmarking.
[DYNAMIC_EXECUTION]: The script scripts/benchmark_model.py dynamically loads its companion script scripts/benchmark_via_builtin.py using importlib.util. This is a standard modularization technique for Python applications and does not involve executing unverified code from external or untrusted sources.

benchmark-model-kernels