sentence-transformers
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to install the
sentence-transformerspackage from official package registries and provides code examples that fetch pre-trained models from Hugging Face. These downloads are standard for the library's functionality and target well-known, established services. - [INDIRECT_PROMPT_INJECTION]: The skill processes external text data to generate embeddings and perform semantic search, creating a potential ingestion surface for untrusted content. However, the skill does not expose any dangerous capabilities—such as file system writes, network exfiltration, or arbitrary command execution—that could be triggered by malicious instructions embedded in the processed data.
- [REMOTE_CODE_EXECUTION]: While the skill downloads pre-trained models which are executed by the transformer framework, these are fetched from official repositories associated with the library (e.g., Hugging Face, Microsoft, Allen AI) and represent standard machine learning operations rather than unauthorized code execution.
Audit Metadata