Lora Finetune

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:51 AM UTC
• Version: 1.0.0

Overview

This skill is a local image LoRA training helper, but it needs Review because its documentation materially mismatches the scripts and it can download unpinned Hugging Face models using a Hugging Face token.

Install only if you are comfortable running local training code that downloads models from Hugging Face. Use a read-only Hugging Face token, verify or pin model repositories before running, and note that the included training script is for FLUX by default while the documentation describes Stable Diffusion and LLM scoring that are not actually implemented.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/train_lora.py:15

Finding

Arbitrary Unpinned Hugging Face Model Repository Loading

Content

View full analysis

Vulnerability Details

File Location: scripts/train_lora.py:15,45-48
Vulnerability Type: Unpinned and user-selectable remote model dependency
Risk Level: Medium

Vulnerable Code

python

p.add_argument("--model_id", default="black-forest-labs/FLUX.1-schnell")

python

pipe = FluxPipeline.from_pretrained(
    args.model_id,
    torch_dtype=torch.float32,
)

Technical Analysis

The --model_id argument permits the caller to select an arbitrary Hugging Face repository, and FluxPipeline.from_pretrained() downloads model artifacts without specifying an immutable revision or verifying expected artifact hashes.

This creates a supply-chain trust boundary that is not enforced by the script. A repository may change after the skill has been audited, while an attacker who can influence command-line arguments can redirect loading to an attacker-controlled repository. The code does not require an approved repository, immutable commit, or known artifact digest.

Loading an untrusted model can cause availability and integrity risks through malformed, poisoned, or unexpectedly large artifacts. Depending on the installed versions and model serialization formats supported by the underlying libraries, unsafe serialized artifacts may also increase the risk of code execution during deserialization. The reviewed code does not explicitly enable remote custom code, so remote-code execution is not established as an unconditional outcome.

Attack Path

1. An attacker gains influence over the arguments used to invoke train_lora.py, or compromises a mutable upstream model repository.
2. The attacker supplies an untrusted repository through --model_id, or replaces artifacts in the configured repository's unpinned branch.
3. FluxPipeline.from_pretrained() downloads and parses the current repository artifacts.
4. Malformed or oversized artifacts may exhaust memory or storage and terminate training; ...[truncated 900 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unrestricted --model_id input with an allowlist of approved repository identifiers.
2. Pin every approved model to an immutable Hugging Face commit:

   python

   pipe = FluxPipeline.from_pretrained(
       approved_model_id,
       revision="FULL_IMMUTABLE_COMMIT_HASH",
       torch_dtype=torch.float32,
       use_safetensors=True,
       trust_remote_code=False,
   )
   

3. Require safetensors and reject pickle-based formats wherever supported.
4. Record and verify cryptographic hashes for all expected downloaded artifacts.
5. Validate artifact sizes and available disk and memory capacity before loading.
6. Run model acquisition and parsing in a restricted environment with minimal filesystem permissions, no unnecessary credentials, and network access limited to approved Hugging Face endpoints.
7. Separate model download from training so artifacts can be scanned and approved before use.
8. Lock tested versions of diffusers, transformers, peft, torch, and related dependencies in a dependency lock file.

T08 · Insecure Dependencies

Note

• Location: scripts/compare_models.py:13

Finding

Mutable Remote Stable Diffusion Dependency Used Without Revision or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: scripts/compare_models.py:13,22
Vulnerability Type: Unpinned remote model dependency
Risk Level: Low

Vulnerable Code

python

model_id = "stable-diffusion-v1-5/stable-diffusion-v1-5"

python

pipe = StableDiffusionPipeline.from_pretrained(model_id, torch_dtype=torch.float32)

Technical Analysis

The comparison script identifies a Hugging Face model repository by name but does not pin an immutable repository revision or verify downloaded artifact hashes. As a result, executions at different times may load different artifacts under the same identifier.

Although the repository identifier is hardcoded and therefore less exposed than the user-controlled training model identifier, the script still relies on the continued integrity of a mutable remote source. A compromised upstream repository or unexpected revision change could introduce poisoned, malformed, or excessively large model artifacts.

The reviewed code does not explicitly enable custom remote Python code. Therefore, direct remote-code execution is not confirmed from this call alone, but unsafe artifact handling in the installed dependency stack remains a supply-chain concern.

Attack Path

1. An attacker compromises the referenced remote repository, its publishing credentials, or another relevant part of the model distribution chain.
2. Model artifacts associated with the mutable default revision are replaced or altered.
3. A user executes compare_models.py.
4. StableDiffusionPipeline.from_pretrained() retrieves and loads the altered artifacts.
5. The artifacts may manipulate generated results, consume excessive local resources, or trigger risks present in vulnerable deserialization dependencies.

Impact Assessment

The likely impact includes compromised evaluation integrity, misleading comparison images, non-reproducible results, and denial of service through memory, disk, or ...[truncated 281 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the model to a reviewed immutable commit:

   python

   pipe = StableDiffusionPipeline.from_pretrained(
       model_id,
       revision="FULL_IMMUTABLE_COMMIT_HASH",
       torch_dtype=torch.float32,
       use_safetensors=True,
       trust_remote_code=False,
   )
   

2. Verify expected artifact hashes before loading the pipeline.
3. Download and approve model artifacts in a separate controlled step rather than retrieving mutable content during evaluation.
4. Enforce safe serialization formats and reject unexpected files.
5. Restrict network access to approved model registries and run evaluation with minimal local privileges.
6. Pin the versions and hashes of Python dependencies responsible for repository downloads and model deserialization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description overstates and partially misidentifies the code’s purpose. While the script is indeed a LoRA fine-tuning workflow for an image generation model on Apple Silicon, it is specifically implemented for FLUX.1-schnell via diffusers' FluxPipeline, not Stable Diffusion. It also lacks two prominent declared components: dataset preparation and evaluation with LLM-as-judge scoring. The actual code only reads pre-existing image-caption pairs, trains LoRA adapters on the transformer, and saves outputs. Because the model family and major pipeline stages differ from the declared description, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly requires an HF_TOKEN and states that it performs outbound network access to Hugging Face, but the operational instructions do not prominently warn users that credentials will be used and models will be downloaded over the network. This creates a real risk of users supplying sensitive tokens without understanding when they are transmitted or what remote resources will be contacted, increasing the chance of credential misuse, overbroad token exposure, or accidental policy violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.