Security audit

Low-Resource AI Researcher

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real medical model-training skill, but it needs review because it can trust remote model code and uses broad unpinned ML dependencies.

Install only in an isolated environment, pin and review dependency versions, and use trusted model and dataset repositories. Disable `trust_remote_code` unless you intentionally need it for a vetted model. Do not train on identifiable patient data unless you have authorization and controls for datasets, logs, checkpoints, and generated outputs.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Enabling trust_remote_code allows model and tokenizer repositories to supply and execute arbitrary Python code during from_pretrained() calls. In a training tool that accepts configurable model names and may pull assets from remote hubs, this creates a direct code-execution path that can compromise the host, steal credentials or data, or tamper with training outputs.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill is explicitly designed for medical-domain fine-tuning and references datasets such as MIMIC-III and clinical notes, yet its documentation only gives a generic compliance note and does not provide concrete safeguards for handling PHI/PII in datasets, checkpoints, logs, or generated outputs. In this context, insufficient privacy guidance can lead users to train on sensitive medical data and persist artifacts that leak patient information through model memorization, logs, or saved outputs.

Unpinned Dependencies

Low

Category: Supply Chain
Content: accelerate dataclasses datasets flash_attn
Confidence: 95% confidence
Finding: The dependency `accelerate` is unpinned, so installs may resolve to different versions over time, including versions with newly introduced security flaws or breaking behavior. In an ML training skill that pulls a large Python dependency chain, this weakens supply-chain integrity and reproducibility.

Unpinned Dependencies

Low

Category: Supply Chain
Content: accelerate dataclasses datasets flash_attn peft
Confidence: 84% confidence
Finding: `dataclasses` is unpinned, which reduces reproducibility and can expose installations to unexpected dependency changes. However, this package is generally low risk in this context and on modern Python versions may be unnecessary, so the security impact is limited.

Unpinned Dependencies

Low

Category: Supply Chain
Content: accelerate dataclasses datasets flash_attn peft skills
Confidence: 95% confidence
Finding: The unpinned `datasets` dependency allows uncontrolled upgrades or resolver changes that may introduce vulnerable transitive packages or incompatible behavior. Because this skill likely downloads and processes external model/data assets, predictable dependency versions are important for supply-chain safety.

Unpinned Dependencies

Low

Category: Supply Chain
Content: accelerate dataclasses datasets flash_attn peft skills torch
Confidence: 99% confidence
Finding: `flash_attn` is unpinned and also separately flagged with a known vulnerability, making version drift especially dangerous. In a GPU/LLM training workflow, this increases the chance of installing a vulnerable build with insecure deserialization or related native-extension risks.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dataclasses datasets flash_attn peft skills torch transformers
Confidence: 93% confidence
Finding: The unpinned `peft` dependency permits uncontrolled version changes and increases exposure to supply-chain risk through both direct and transitive dependencies. While not inherently critical on its own, it weakens build integrity in a model-training environment.

Unpinned Dependencies

Low

Category: Supply Chain
Content: datasets flash_attn peft skills torch transformers
Confidence: 97% confidence
Finding: The `skills` package is unpinned, and its generic name increases the risk of dependency confusion or unintended resolution to the wrong package source. In an agent skill ecosystem, that ambiguity makes this more dangerous than a typical unpinned package because a malicious package with the same name could be installed.

Unpinned Dependencies

Low

Category: Supply Chain
Content: flash_attn peft skills torch transformers
Confidence: 99% confidence
Finding: `torch` is unpinned and also has multiple known advisories, so leaving the version unconstrained creates substantial risk of installing a vulnerable or incompatible release. Given that PyTorch often handles model loading and serialized artifacts, version control is especially important in this context.

Unpinned Dependencies

Low

Category: Supply Chain
Content: peft skills torch transformers
Confidence: 99% confidence
Finding: `transformers` is unpinned and flagged separately with multiple advisories, so dependency drift can directly expose the environment to known parser, tempfile, or deserialization issues. Because this skill is specifically for medical LLM training, it likely processes external models/tokenizers/configs, making unsafe versions more dangerous.

Known Vulnerable Dependency: flash_attn — 1 advisory(ies): CVE-2026-31253 (flash-attention contains an insecure deserialization vulnerability in its checkp)

High

Category: Supply Chain
Confidence: 92% confidence
Finding: The file depends on `flash_attn`, and the static analysis reports a known insecure deserialization advisory affecting it. In a model-training stack, deserialization vulnerabilities are particularly dangerous because checkpoints and model artifacts are commonly downloaded from external sources, potentially leading to code execution during load operations.

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: The declared `torch` dependency is associated with multiple serious advisories including remote code execution and unsafe deserialization behaviors. This is highly relevant in an LLM training skill because PyTorch frequently loads checkpoints and serialized tensors, so exploitation could compromise the training host or developer workstation.

Known Vulnerable Dependency: transformers — 10 advisory(ies): CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2024-3568 (Transformers Deserialization of Untrusted Data vulnerability) +7 more

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: The `transformers` dependency is flagged with multiple advisories, including insecure temporary file handling, ReDoS, and deserialization-related issues. This is especially dangerous in this skill's context because medical LLM workflows commonly ingest external pretrained models, tokenizers, processors, and configs, which expands the attack surface substantially.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/main.py:602