image-assets
Warn
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill enables remote code execution by setting
trust_remote_code=Truewhen loading image segmentation models (briaai/RMBG-2.0andZhengPeng7/BiRefNet) via the Hugging Face Transformers library. This allows custom logic defined in the remote model repositories to execute during model initialization. - [EXTERNAL_DOWNLOADS]: The skill performs automated downloads of infrastructure tools and libraries at runtime. It fetches
get-pip.pyfrombootstrap.pypa.ioto bootstrap its environment if needed, and installs multiple Python packages from PyPI and thesharplibrary from NPM into isolated local directories (.venvand.node-deps). - [DYNAMIC_EXECUTION]: The skill dynamically executes downloaded content, such as the
get-pip.pyscript, and manages its own runtime environment by installing dependencies programmatically during its first run. - [COMMAND_EXECUTION]: The skill extensively uses the
subprocessmodule in Python andchild_processin Node.js to coordinate the execution of its various scripts and manage external tools likepip,npm,node,pngquant, andoxipng.
Audit Metadata