speculative-decoding
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone code from third-party GitHub repositories (
FasterDecoding/Medusaandhao-ai-lab/LookaheadDecoding) that are not recognized as trusted vendors or well-known services. - [COMMAND_EXECUTION]: The installation process involves running
pip install -e .within the cloned third-party directories, which triggers the execution of arbitrary code in the repositories' setup scripts. - [DYNAMIC_EXECUTION]: In
references/medusa.md, the skill usestorch.load()to load model weights; this function uses pickle for deserialization, which is inherently unsafe and can execute arbitrary code if the weight file is malicious. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing untrusted user prompts without incorporating boundary markers or input sanitization. 1. Ingestion points: Prompt variables in Python code blocks within
SKILL.md. 2. Boundary markers: None present in the instruction snippets. 3. Capability inventory: Performs LLM inference using transformers and medusa-heads. 4. Sanitization: None provided.
Audit Metadata