Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for using MLX Swift language-model APIs, with expected model downloads, local model/data access, and cache/checkpoint examples disclosed in context.
Before using the examples, expect outbound downloads from HuggingFace and local caching of large model files. Treat downloaded models, prompt-cache files, adapter checkpoints, and training datasets as potentially sensitive, and pin trusted model IDs or revisions when reproducibility or supply-chain control matters.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
await container.perform { context in
let result = context.model(input)
eval(result) // Evaluate before crossing boundary
return result.item(Float.self) // Return primitive
}
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
await container.perform { context in
let result = context.model(input)
eval(result) // Evaluate before crossing boundary
return result.item(Float.self) // Return primitive
}
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
await container.perform { context in
let result = context.model(input)
eval(result) // Evaluate before crossing boundary
return result.item(Float.self) // Return primitive
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Access configuration (async property)
let config = await container.configuration
// Access tokenizer
let tokenizer = await container.tokenizer
// Access processor
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. **Download**: Model weights fetched from HuggingFace (cached locally)
2. **Parse config.json**: Determine `model_type` and configuration
3. **Create model**: TypeRegistry maps type to initializer
4. **Load weights**: `.safetensors` files loaded into model
5. **Load tokenizer**: From `tokenizer.json` / `tokenizer_config.json`
6. **Load EOS tokens**: From `generation_config.json` (overrides config.json)
The skill explicitly states that models are downloaded from HuggingFace automatically, but it does not warn the user that invoking the example will trigger outbound network access and fetch third-party artifacts. In an agent skill context, hidden network access can violate operator expectations, bypass allowlist controls, and increase supply-chain risk if remote model identifiers are changed or untrusted.
This markdown file includes examples for saving and loading prompt caches to a file and notes that metadata is stored in the .safetensors file. Because prompt caches and metadata can contain user-derived content, the documentation should warn that serialization persists data to disk and may have privacy implications.
This markdown file documents adapter.fuse(with:) as a permanent merge and says weights are "baked in," but it does not include a clear caution advising users that this changes model state and may require reloading the base model to undo. For markdown files, destructive or integrity-affecting behaviors should be accompanied by an explicit warning.
This markdown file includes executable example code that reads training data from local .txt and .jsonl files, but the surrounding documentation does not explicitly warn users that the example accesses filesystem contents. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy; here the example processes user-provided local data without any disclosure note.
No suspicious patterns detected.