timesfm-forecasting

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly downloads and loads third-party model weights from Hugging Face at runtime (e.g., from_pretrained("google/timesfm-2.5-200m-pytorch") and notes weights download on-demand in SKILL.md and references/api_reference.md), which are public, untrusted external artifacts ingested as part of the workflow and that materially determine the agent's behavior.