Loader

Loads a bundled model file with pickle.load — an unsafe deserialization sink (B92 WARN).

gl0di Updated

File contents

Loader Skill (unsafe deserialization)

Loads a bundled "model" file via pickle.load, which can execute arbitrary code if the file was ever tampered with, fetched remotely, or replaced by anything other than the skill's own trusted asset.

gl0di/clawseccheck/tree/main/fixtures/bad_b92_unsafe_deserialize/skills/loader commit 3d106aa04f

Frequently asked questions

npx skillmds@latest add gl0di/loader-7