hugging-face-model-trainer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow uses hf_benchmarks.py to fetch leaderboards and search Hugging Face datasets, which ingests third-party benchmark metadata and model leaderboard submissions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill documentation and script templates provide external GitHub and Hugging Face raw script URLs (such as https://raw.githubusercontent.com/huggingface/trl/main/examples/scripts/grpo.py and dataset inspector raw scripts) that are intended to be executed or loaded via the hf_jobs() tool at runtime.