plagiarism-checker
Warn
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The
ReferenceIndex.loadmethod insemorigin/indexer.pyusespickle.load()to deserialize metadata from disk. The 'pickle' module is insecure because it can execute arbitrary code during deserialization. If an attacker provides a crafted.metafile alongside a FAISS index, loading it could lead to arbitrary command execution on the host machine. - [EXTERNAL_DOWNLOADS]: The skill uses the
sentence-transformerslibrary, which automatically downloads pre-trained models (e.g.,all-MiniLM-L6-v2) from Hugging Face on the first run. While these are from a well-known service, the skill downloads approximately 90MB of external binary data and code at runtime. - [COMMAND_EXECUTION]: The tool relies on several complex dependencies (FAISS, Sentence-Transformers) that involve C++ extensions and BLAS libraries. While not directly executing shell commands via
subprocess, the heavy reliance on complex binary dependencies increases the attack surface for local execution vulnerabilities.
Audit Metadata