The Agent Skills Directory

[SAFE]: The skill is a legitimate resource for implementing machine learning in JavaScript. It follows standard practices for dependency management and resource loading.
[EXTERNAL_DOWNLOADS]: The skill fetches model weights and configuration from Hugging Face Hub, a trusted organization. It also supports loading the library from JSDelivr, a well-known content delivery network. These downloads are essential for the skill's primary function and originate from reputable sources.
[REMOTE_CODE_EXECUTION]: Machine learning models in ONNX format are downloaded and executed using the ONNX Runtime (WASM/WebGPU). This execution is restricted to the model's inference logic and occurs within the browser's or Node.js runtime's security sandbox.
[DATA_EXFILTRATION]: The library provides hooks for custom fetch requests and remote host configuration. These features are documented for use in authenticating with private registries and do not show signs of malicious exfiltration. Sensitive tokens are handled via standard environment configuration patterns.
[PROMPT_INJECTION]: The skill processes untrusted input data (text, image, audio) through its machine learning pipelines, creating a surface for indirect prompt injection. Given the context of machine learning inference, this is an inherent risk factor that is managed by the underlying models and does not indicate a flaw in the skill's implementation.

transformers-js