Security audit

huawei-cloud-msmodelslim-model-adapt

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for msModelSlim adapter work, but its default workflow can run code from model repositories without clearly warning the user.

Review before installing. Use this only with model repositories you trust, have reviewed, and preferably pinned to exact revisions. Avoid trust_remote_code=True for untrusted models, run verification in an isolated environment, and expect bash install.sh plus config.ini changes to alter your local msModelSlim setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares executable tools (`python3`, `bash`) and provides commands that read and write local files, download packages, and run installation scripts, yet there is no explicit permissions model describing filesystem or shell access. This creates a real capability/authorization mismatch: users or orchestration systems may underestimate what the skill can do, increasing the risk of unintended command execution, file modification, or environment changes.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: Calling from_config(..., trust_remote_code=True) permits execution of custom Python code from a model repository during model construction. If an attacker can influence the model path or the underlying repository contents, running this script can execute arbitrary code on the host, which is especially risky in a model-adaptation workflow that may process third-party Hugging Face model artifacts.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: AutoConfig.from_pretrained(..., trust_remote_code=True) can execute repository-supplied custom configuration/modeling code while resolving the config. This expands the attack surface to the very first loading step, so a malicious or compromised model directory can trigger arbitrary code execution before any further validation occurs.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script unconditionally passes --trust_remote_code True to the quantization tool, which can cause arbitrary Python code from model repositories to execute during model loading. In a workflow that processes user-selected or externally sourced models, this creates a high-risk remote code execution path that could compromise the host environment, exfiltrate credentials, or tamper with outputs.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger list contains broad terms such as "adapter," "quantization," "transformers," and "LLM," which are generic across many unrelated workflows. Overly broad activation can cause the skill to be invoked in contexts the user did not intend, increasing the chance that it suggests or executes shell/python actions against the wrong project or data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation instructs users to set trust_remote_code=True when loading a model, but does not warn that this allows execution of model repository Python code during loading. In a skill focused on adapting external Transformer models, users are likely to apply this to third-party model sources, which increases the chance of running untrusted code on the host environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly instructs users to run msModelSlim quantization with `--trust_remote_code True`, which can cause execution of model-supplied Python code during loading. In a verification workflow that may be applied to third-party or newly adapted models, this materially increases the risk of arbitrary code execution on the analyst's machine, especially because the documentation provides no warning, sandboxing guidance, or trust precondition.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This second example repeats the unsafe pattern and normalizes use of `--trust_remote_code True` in another quantization path, reinforcing risky behavior across the workflow. Because this skill is specifically about adapting and verifying models, users are likely to test unfamiliar repositories, making remote code execution risk more acute in context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.