stable-baselines3
Warn
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [Dynamic Execution] (MEDIUM): The skill utilizes Stable Baselines3 loading functions which rely on the unsafe pickle module for deserialization.\n
- Evidence: Scripts
evaluate_agent.pyandtrain_rl_agent.pyusePPO.load()andVecNormalize.load(). Loading crafted model files from untrusted sources enables arbitrary code execution.\n- [Indirect Prompt Injection] (LOW): The skill processes external data from Gymnasium environments, creating a vulnerability surface for indirect prompt injection.\n - Ingestion points:
observationandinfodictionaries inscripts/custom_env_template.pyandscripts/evaluate_agent.py.\n - Boundary markers: Absent. No specific delimiting of observation data in prompts is mentioned.\n
- Capability inventory:
model.save()(file write),os.makedirs()(filesystem manipulation), andSubprocVecEnv(subprocess spawning) inscripts/train_rl_agent.py.\n - Sanitization: Absent. Observations are used directly for model predictions without validation.\n- [Unverifiable Dependencies & Remote Code Execution] (LOW): The skill documentation recommends installing external dependencies.\n
- Evidence:
SKILL.mdcontainsuv pip install stable-baselines3. This refers to a standard, well-known package on PyPI, and the risk is considered low per [TRUST-SCOPE-RULE].
Audit Metadata