The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file scripts/load_checkpoint.py contains a custom TorchUnpickler class used to load model weights. This class inherits from pickle.Unpickler and includes a fallback to the standard find_class method. Since pickle is inherently unsafe, this allows for arbitrary code execution if a maliciously crafted checkpoint file is processed. The skill specifically instructs the agent to load these files from a remote URL or user uploads.
[EXTERNAL_DOWNLOADS]: The skill (in SKILL.md and scripts/reverso.py) downloads binary model checkpoints from a third-party repository on HuggingFace (https://huggingface.co/shinfxh/reverso/). The author of this repository is not a recognized trusted vendor, and the downloaded binary data is processed using the insecure deserialization logic mentioned above.
[COMMAND_EXECUTION]: The setup instructions in SKILL.md perform a system-level installation using uv pip install numba --system --break-system-packages. Using the --break-system-packages flag bypasses standard Python environment protections and can lead to system instability or conflicts.

forecasting-reverso