huggingface-spaces

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include direct .whl binaries served from GitHub Releases under individual/unknown accounts (LDYang694, adithyaxx), which is a high-risk pattern for distributing untrusted executable artifacts (prebuilt wheels) and matches multiple high-risk indicators.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md instructs using Gradio/ZeroGPU handlers where the user’s runtime prompt string (free text) is passed directly into the @spaces.GPU-decorated function (e.g., generate(prompt: str)), meaning outsider-authored text is ingested by the Space’s code at call time.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes examples that run pip installs from git URLs at runtime (e.g., pip install --no-build-isolation --no-deps git+https://github.com/graphdeco-inria/diff-gaussian-rasterization.git, git+https://github.com/tatsy/torchmcubes.git, and git+https://github.com/facebookresearch/demucs) which fetch and execute remote code inside @spaces.GPU / module-startup steps and are presented as required for JIT builds, so they are runtime external dependencies that execute remote code.