huggingface-local-models

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, the agent searches the Hugging Face Hub and fetches outsider-authored model pages/snippets and repo inventory via https://huggingface.co/models?..., https://huggingface.co/<repo>?local-app=llama.cpp, and https://huggingface.co/api/models/<repo>/tree/main?recursive=true, which are populated by third-party users.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime fetching and execution of remote code via "git clone https://github.com/ggml-org/llama.cpp" followed by build steps, and also directs fetching Hugging Face pages (e.g., "https://huggingface.co/?local-app=llama.cpp" and "https://huggingface.co/api/models//tree/main?recursive=true") whose page/JSON content is explicitly used at runtime to determine model selection and build commands, so these URLs can execute code or directly control agent instructions.