Loader Skill (unsafe deserialization)
Loads a bundled "model" file via pickle.load, which can execute arbitrary code if the
file was ever tampered with, fetched remotely, or replaced by anything other than the
skill's own trusted asset.
Loads a bundled model file with pickle.load — an unsafe deserialization sink (B92 WARN).
npx skillmds@latest add gl0di/loader-7 Loads a bundled "model" file via pickle.load, which can execute arbitrary code if the
file was ever tampered with, fetched remotely, or replaced by anything other than the
skill's own trusted asset.
gl0di/clawseccheck/tree/main/fixtures/bad_b92_unsafe_deserialize/skills/loader commit 3d106aa04f