huggingface-community-evals

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The examples and scripts explicitly show running the Hugging Face model "microsoft/phi-2" with the --trust-remote-code flag (e.g., SKILL.md and examples/USAGE_EXAMPLES.md), which causes the runtime to fetch and execute remote code from the model repository on the Hugging Face Hub.