transformers

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the Hugging Face library to download pre-trained models and datasets. These downloads target well-known machine learning repositories (Hugging Face Hub).
  • Evidence: Examples in SKILL.md using AutoModel.from_pretrained() and load_dataset() for models like bert-base-uncased, gpt2, and Llama-2.
  • [INDIRECT_PROMPT_INJECTION]: As a tool for processing natural language and datasets, the skill has an inherent surface for indirect prompt injection if it processes untrusted data without sanitization.
  • Ingestion points: Untrusted data enters the context via load_dataset and inputs to pipeline() or tokenizer() calls.
  • Boundary markers: Absent in the high-level code snippets provided.
  • Capability inventory: The skill performs filesystem writes to ./results during training and network requests to fetch models.
  • Sanitization: Not explicitly implemented in the provided usage examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 12:32 PM