huawei-cloud-msmodelslim-model-adapt

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:36 PM UTC
• Version: 1.0.0

Overview

This skill is mostly a coherent msModelSlim adapter workflow, but it normalizes unsafe model loading that can run code from model artifacts without clear warnings or opt-in.

Install only if you are adapting trusted, reviewed models in an isolated development environment. Avoid running the provided verification scripts on arbitrary Hugging Face, ModelScope, or downloaded model directories unless you have reviewed the model code, pinned the source revision, and are comfortable with local code execution. Review any install.sh before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares executable tools (`python3`, `bash`) and includes instructions that read model files, write adapters, run installation scripts, and execute verification commands, yet it has no explicit permissions declaration governing those capabilities. This creates a mismatch between what the skill can operationally do and what users or the platform may expect, increasing the risk of unintended file-system access or shell execution when the skill is invoked.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Calling from_config(..., trust_remote_code=True) permits execution of custom model code supplied by the model repository or local model package. In a workflow that processes arbitrary adapter/model inputs, this can lead to arbitrary code execution during test-model generation, which is broader and riskier than necessary for basic config-based model instantiation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: AutoConfig.from_pretrained(..., trust_remote_code=True) allows loading custom configuration/model code from an untrusted model path or repository. In this skill context, users are expected to adapt new third-party Transformers models, which makes untrusted input likely and increases the chance of arbitrary code execution during what should be a metadata/config loading step.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This script explicitly passes --trust_remote_code True to the model tooling, which can cause Python code from a model repository to be imported and executed during quantization. If an attacker supplies a malicious local or remote model path, arbitrary code may run in the environment executing this skill, potentially leading to credential theft, filesystem access, or broader host compromise.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger list is broad and contains many generic terms such as "adapter," "quantization," "transformers," and "LLM," which could cause the skill to activate in conversations unrelated to this specific Huawei Cloud/msModelSlim workflow. Over-broad activation increases the chance that a user is steered into running shell/python-based setup or modification steps in the wrong context, especially because the skill supports code execution and file operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide explicitly instructs users to run `bash install.sh` without explaining what the script changes, what privileges it may require, or how to inspect it first. In a developer-facing adapter/quantization workflow this is common, but it still creates supply-chain and operational risk because users may execute an opaque script directly from the repository.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The troubleshooting guide instructs users to set trust_remote_code=True when loading a model, but does not warn that this allows execution of Python code supplied by the model repository. In the context of a model-adapter and quantization skill, users are likely to load third-party Hugging Face or similar model artifacts, so this documentation can normalize unsafe loading of untrusted models and lead to arbitrary code execution on the analyst's or build host.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide explicitly instructs users to run msModelSlim/Transformers with `--trust_remote_code True`, which permits execution of arbitrary Python code supplied by the model repository. In this skill context, users are adapting and validating third-party models, so following the guide against an untrusted or compromised model source could lead to local code execution, credential theft, or CI/agent compromise.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This second example repeats the unsafe pattern, normalizing `--trust_remote_code True` as part of the standard verification workflow without any caution. Repetition increases the chance that users or automation will treat arbitrary remote model code execution as routine, expanding the attack surface during quantization and adapter validation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script silently enables execution of remote model code without notifying the user, which creates a hidden code-execution boundary in a workflow that appears to be a routine quantization step. In the context of an adapter/quantization skill that may be used on third-party LLM or VLM models, this materially increases danger because users are likely to process untrusted model repositories.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script falls back to `torch.load` on `pytorch_model.bin`, which uses Python pickle semantics and can execute attacker-controlled code during deserialization. Because the paths are supplied via CLI and this skill operates on externally provided model artifacts, a malicious model directory could trigger arbitrary code execution simply by being verified.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.