helsinki-nlp-model-training
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's code (SKILL.md) directly calls AutoTokenizer.from_pretrained(...) and AutoModelForSeq2SeqLM.from_pretrained(...) with Hugging Face model IDs (e.g., "Helsinki-NLP/opus-mt-mul-en"), which downloads and loads models from the public Hugging Face Hub (a user-contributed, untrusted third-party source) and uses those artifacts at runtime to generate translations and influence training/evaluation decisions.
Audit Metadata