transformers
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the Hugging Face library to download pre-trained models and datasets. These downloads target well-known machine learning repositories (Hugging Face Hub).
- Evidence: Examples in
SKILL.mdusingAutoModel.from_pretrained()andload_dataset()for models likebert-base-uncased,gpt2, andLlama-2. - [INDIRECT_PROMPT_INJECTION]: As a tool for processing natural language and datasets, the skill has an inherent surface for indirect prompt injection if it processes untrusted data without sanitization.
- Ingestion points: Untrusted data enters the context via
load_datasetand inputs topipeline()ortokenizer()calls. - Boundary markers: Absent in the high-level code snippets provided.
- Capability inventory: The skill performs filesystem writes to
./resultsduring training and network requests to fetch models. - Sanitization: Not explicitly implemented in the provided usage examples.
Audit Metadata