PyTorch

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:05 PM UTC
• Version: 1.0.0

Overview

This is a simple PyTorch tips skill with no active code, though its checkpoint-loading advice should be made safer before users copy it blindly.

This skill appears safe to install as a reference guide, but treat the checkpoint-loading snippet as incomplete: only load checkpoints from trusted sources, prefer torch.load(..., weights_only=True) where supported, and verify model files before using them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33

Finding

Unsafe PyTorch Checkpoint Deserialization Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-34
Vulnerability Type: Unsafe deserialization
Risk Level: High

Vulnerable code snippet:

python

- Loading: create model first, then `model.load_state_dict(torch.load(path))`
- `map_location` for cross-device — `torch.load(path, map_location='cpu')` if saved on GPU

Technical Analysis

The checkpoint-loading examples call torch.load() without explicitly enabling restricted weight-only deserialization or requiring the checkpoint to originate from a trusted source. PyTorch checkpoint files can use pickle-based serialization. On PyTorch versions or configurations that permit unrestricted pickle loading, deserializing a malicious checkpoint can invoke attacker-controlled object reconstruction logic and execute arbitrary Python code.

map_location='cpu' only controls where tensors are loaded; it does not make an untrusted serialized object safe. Although newer PyTorch releases may default to restricted weight-only loading, relying on a version-dependent default is not a sufficient security boundary.

Attack Path

1. An attacker creates a malicious PyTorch checkpoint containing a crafted pickle payload.
2. The attacker supplies the file through a model repository, download link, shared storage location, or replacement of an expected local checkpoint.
3. A user follows the Skill's documented loading pattern and passes the attacker-controlled path to torch.load().
4. In a PyTorch environment permitting unrestricted pickle deserialization, the crafted reconstruction routine runs while the checkpoint is loaded.
5. The payload executes with the privileges of the Python process before or during the subsequent load_state_dict() operation.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the account running the Python process. The attacker could read or modify files available to that account, acces ...[truncated 362 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly request restricted weight-only loading:

  python

  state_dict = torch.load(
      path,
      map_location="cpu",
      weights_only=True,
  )
  model.load_state_dict(state_dict)
  

• Require checkpoints to come from trusted and authenticated sources.
• Verify downloaded checkpoints against a securely distributed cryptographic hash or signature.
• Pin a maintained PyTorch version that supports weights_only=True; do not rely on version-dependent defaults.
• Validate that the loaded object has the expected state-dictionary structure and reject unexpected object types or keys.
• If a legacy checkpoint requires unrestricted deserialization, convert it only in an isolated, disposable environment without credentials, sensitive files, or unnecessary network access.
• Add an explicit warning that map_location does not mitigate pickle deserialization risks and that untrusted checkpoints must never be loaded with unrestricted pickle support.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.