aqua-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI explicitly supports downloading models from the HuggingFace Hub (e.g., meta-llama/Llama-3.1-8B-Instruct — https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct via --download_from_hf) and documents the vLLM flag --trust-remote-code, which together indicate the skill can fetch remote model code at runtime that may be executed.