The Agent Skills Directory

[DYNAMIC_EXECUTION]: Static analysis tools incorrectly flagged an eval() call in scripts/transcribe.py. Technical review confirms this is a call to .eval() on a PyTorch model object (setting it to evaluation mode), which is unrelated to the dangerous Python eval() function and constitutes a false positive.
[REMOTE_CODE_EXECUTION]: The script scripts/transcribe.py uses AutoModel.from_pretrained with trust_remote_code=True to load the SheetSage2 model from Hugging Face. While this executes repository-supplied code, the skill instructions advise users to use reviewed and pinned revisions to mitigate risk, which is a standard requirement for the specific model architecture used.
[EXTERNAL_DOWNLOADS]: The scripts/listen.py utility downloads the abcjs music notation library from unpkg.com, a well-known CDN for open-source packages. This is used to build a local listening page and the download occurs using standard library functions with no evidence of exfiltration or redirection.
[DATA_EXPOSURE_AND_EXFILTRATION]: The scripts/listen.py script includes proactive security measures to prevent credential leakage. It scans JSON metadata for common secret keys (e.g., api_key, token) and uses regex to detect bearer tokens or Hugging Face tokens, withholding any files that appear to contain sensitive information from being copied into the generated listening bundle.

yue2-music