train-sentence-transformers

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/mine_hard_negatives.py, the script loads outsider-authored text from a user-supplied Hugging Face dataset id via load_dataset(args.dataset, ...) and then passes the resulting dataset rows (anchor/positive/corpus text) into sentence_transformers.util.mine_hard_negatives(...) at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains examples that fetch and execute remote scripts at runtime (curl -LsSf https://hf.co/cli/install.sh | bash -s and hf_jobs / hf jobs commands that pass "https://huggingface.co/USERNAME/scripts/resolve/main/..." as the script), which would execute remote code if run.