XOne - The Open Agentic Studio
C elevated
- capability exposure inferred + 35
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: OpenAI key, GitHub fine-grained PAT, HuggingFace token · dynamic exec: __import__(), eval()/exec(), pickle.loads(), __import__ sink · obfuscated payload: base64 …
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 7867e6d · analyzer v33 · 23h ago
danger signals161
- dynamic code execution __import__() abhishekpandaOfficial-XOne-7867e6d/studio/backend/core/training/worker.py :1165
__import__(import_name) - dynamic code execution __import__() abhishekpandaOfficial-XOne-7867e6d/studio/backend/hub/tests/conftest.py :88
__import__(name) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_browse_denylist.py :68
exec(compile(module, "<extracted studio_db.py>", "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_cloudflare_tunnel.py :1294
exec(compile(func_src, "<verify_global_reachability>", "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_export_gguf_discovery.py :689
exec( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_export_imatrix_compressed.py :90
exec(_func_src("core/export/export.py", helper), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_frontend_resolution.py :47
exec(code, ns) - dynamic code execution pickle.loads() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_gguf_load_intent_slots.py :80
assert pickle.loads(pickle.dumps(intent)) == intent - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_grouped_mm_rdna4_fallback.py :50
exec(compile(ast.Module(body = fn, type_ignores = []), str(_WORKER_PATH), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_launch_flags_are_capability_gated.py :322
exec(ast.unparse(ast.Module(body = blocks, type_ignores = [])), scope) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_linux_external_media_paths.py :285
exec(compile(module, "<extracted routes/models.py>", "exec"), ns) - dynamic code execution __import__() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_llama_cpp_placement.py :27
__import__(name) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_load_progress_ready_fraction.py :173
rss = LlamaCppBackend._read_rss_bytes(__import__("os").getpid()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_log_bounds.py :145
phase_bytes = eval(phase.group(1).strip()) # noqa: S307 - digits and '*' only - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_mcp_servers.py :690
exec(f"_TOOL_XML_RE = _re.compile({m.group(1)})", ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_metal_paravirtual_guard.py :591
exec(ast.unparse(ast.Module(body = body, type_ignores = [])), scope) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_mlx_inference_backend.py :478
**__import__("os").environ, - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_mlx_training_worker_config.py :383
exec(block, namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_offline_gguf_cache_fallback.py :2933
exec(compile(ast.Module([fn], []), "<any_remote>", "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_qwen_thinking_size_gate.py :34
exec(_GATE, scope) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_rag_embed_llama_server.py :120
**__import__("os").environ, - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_recommended_folders_has_model.py :61
exec(compile(module, f"<extracted {_models_src}>", "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_recommended_folders_permission.py :47
exec(compile(module, f"<extracted {_models_src}>", "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_scan_folder_health.py :581
exec(compile(source, __file__, "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_spec_retry_status_signals.py :63
exec(compile(ast.Module([node], []), str(_ROUTE), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_system_poll_no_cuda_context.py :136
leaked = eval(line[len("LEAKED:") :]) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_tool_xml_strip.py :53
exec(f"_TOOL_XML_RE = _re.compile({_m.group(1)})", _ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_training_finalizing_phase.py :43
exec(compile(ast.Module([node], []), str(_ROUTES_TRAINING), "exec"), ns) - dynamic code execution pickle.loads() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_training_progress_callback.py :292
assert pickle.loads(pickle.dumps(events)) == events - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_transformers_latest.py :1041
exec(helpers, ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_vision_cache.py :727
exec(_VISION_CHECK_INLINE_HELPERS, ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_windows_external_drive_paths.py :35
exec(compile(module, "<extracted routes/models.py>", "exec"), ns) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_worker_activates_correct_transformers.py :128
**__import__("os").environ, - dynamic code execution __import__() abhishekpandaOfficial-XOne-7867e6d/studio/backend/utils/ssm_runtime.py :216
__import__(import_name) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/_grpo_dispatch_source.py :49
exec(compile(ast.Module(body = wanted, type_ignores = []), str(SOURCE_PATH), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/_rl_source.py :76
exec(compile(ast.Module(body = wanted, type_ignores = []), str(SOURCE_PATH), "exec"), namespace) - dynamic code execution __import__() abhishekpandaOfficial-XOne-7867e6d/tests/kaggle/t4_smoke/run_grpo_t4.py :184
module = __import__(path, fromlist = ["*"]) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/kaggle/test_studio_gpu_harness.py :2041
exec(compile(fail_report_src, "<fail_report>", "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/kaggle/test_t4_ci_transport.py :120
exec(compile(source, "<driver-cell>", "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/kaggle/test_t4_payload_assertions.py :1687
exec(compile(_recapture_recipe(), "<recapture-recipe>", "exec"), {"__name__": "__main__"}) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/kaggle/test_t4_smoke_harness.py :1901
exec(compile(source, "run_cell", "exec"), {"__name__": "__main__"}) # noqa: S102 - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_change_system_message.py :26
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_cpo_processor_text_tokenizer.py :63
exec(compile(ast.Module(body = nodes, type_ignores = []), RL_PATH, "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_dpo_vision_processor_passthrough.py :23
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_fast_language_model_text_only.py :91
exec(funcs[name], ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_fast_model_config_passthrough.py :67
exec(funcs[name], ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_get_lora_parameters_bias_fp8_block_size.py :18
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_get_lora_parameters_fp8_block_size.py :18
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_mlx_public_trainer_api.py :989
exec("from trl import *", namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_orpo_processor_text_tokenizer.py :21
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_pad_token_fix.py :36
exec(compile(module, TOK_PATH, "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_remove_special_tokens_no_bos.py :19
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_revision_forwarding.py :167
exec(compile(module, str(LOADER), "exec"), namespace) - dynamic code execution pickle.loads() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_rl_config_pickling.py :64
restored = pickle.loads(pickle.dumps(args)) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_to_sharegpt_optional_none.py :19
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/python/test_v100_fullft_precision.py :41
return eval("(\n" + "\n".join(body) + "\n)") # only string literals + comments - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_is_gpt_oss_detection.py :18
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_is_vlm_detection.py :31
exec(compile(module, SAVE_PATH, "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_preserve_tokenizer_eos_token.py :24
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_prewarm_base_model_hub_cache.py :179
exec( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_quant_method_none_normalization.py :61
exec(loop_src, {"__builtins__": __builtins__}, namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_qwen3_5_vlm_full_finetune_key_remap.py :24
exec(compile(module, str(source), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/saving/test_torchao_remote_code_consent.py :29
exec(compile(ast.Module(body = [fn], type_ignores = []), str(_SAVE_PY), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/security/test_release_desktop_integrity.py :449
exec(body.split("current = json.loads", 1)[0], namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/install/test_base_requirements_reach_install.py :150
exec(compile(module, "<shared base phase>", "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/install/test_rocm_native_linux_lib_dirs.py :67
exec(compile(module, str(path), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/install/test_torch_probe_classification_parity.py :121
exec(compile(ast.Module([node], []), "<live>", "exec"), env) # noqa: S102 - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/tests/studio/studiobench/runtime/browser.py :204
return __import__("os").getpid() - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_cancel_atomicity.py :144
exec( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_cli_studio_stop_windows.py :40
exec(src, ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_hardware_dispatch_matrix.py :413
exec(_ast.get_source_segment(source, node), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_spark_tts_tokenizer_subfolder.py :48
exec(src[start:end], namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_stream_cancel_registration_timing.py :293
exec("import threading, time\n" + "\n\n".join(chunks), mod) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_studio_pid_file_contract.py :36
exec(_func_source(_RUN_SRC, "_pid_file_for_port"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_whisper_binary_probe_denied.py :33
exec(compile(ast.Module([node], []), str(SIDECAR), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_xpu_triton_swap.py :58
exec(compile(src[start : src.index(end, start) + keep], str(STACK), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_apertus_instruct_mapping.py :39
exec(compile(source, MAPPER_PATH, "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_attn_dtype_custom_datatype.py :88
exec(compile(module, str(VISION), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_bad_mappings_redirect.py :21
exec(compile(f.read(), "mapper.py", "exec"), mapper_ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_bnb_checkpoint_skip_modules.py :40
exec(ast.get_source_segment(source, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_broken_tf_does_not_break_import.py :141
exec(ast.unparse(_guard_block()), scope) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_compressed_export_gpu_release.py :63
exec( # noqa: S102 - loading trusted repo source - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_cuda_spoof_reports_free_memory.py :58
tuple(eval(ast.unparse(e), {"__builtins__": {}}, {}) for e in value.elts) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_dataclass_default_backfill.py :97
exec( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_fa2_fast_generate_bypass.py :19
exec(compile(ast.Module(body = [function], type_ignores = []), str(VISION_PATH), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_fast_generate_slow_guard.py :20
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_float32_no_fp16_autocast.py :143
exec(MP_SRC, ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_for_training_generation_flag.py :36
exec(compile(ast.fix_missing_locations(compiled), str(path), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_fp8_device_context.py :86
exec(ast.get_source_segment(source, node), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_gemma_2b_mapper_key.py :24
exec(compile(source, MAPPER_PATH, "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_generate_kwarg_gate.py :17
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_gguf_basename_platform_matrix.py :75
exec(compile(ast.Module([node], []), str(_SAVE_PY), "exec"), ns) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/tests/test_gguf_model_basename.py :44
namespace: dict = {"os": __import__("os")} - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_gguf_model_basename.py :45
exec(compile(ast.Module([node], []), str(_SAVE_PY), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_gguf_windows_native.py :34
exec(compile(ast.Module([node], []), str(_SAVE_PY), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_gradient_checkpointing_restore.py :89
return eval( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_accumulated_loss_hidden_states_signal.py :71
exec(compile(ast.Module(body = body, type_ignores = []), str(SOURCE_PATH), "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_autocast_disabled.py :124
exec(_autocast_helper_source(), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_autocast_per_trainer.py :192
exec(MP_SRC, scope) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_hidden_states_signal.py :339
exec(_BLOCK, namespace) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_packed_raw_logits_nograd.py :311
"os": __import__("os"), - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_packed_raw_logits_nograd.py :349
exec(_packed_block_source(), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_grpo_padded_raw_logits.py :340
exec(_BLOCK_CODE, namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_installer_profile_hardening.py :701
exec(src[start : src.index(")\n", start) + 1], namespace) # noqa: S102 - our own source - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_map_eos_token.py :94
exec(compile(module, CHAT_TEMPLATES_PATH, "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_multi_image_grpo_chunking.py :147
exec(helper_match.group(0), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_new_mapper_fetched_fp8.py :103
exec(compile(installed_source, "mapper.py", "exec"), mapper_ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_new_mapper_no_global_leak.py :39
exec(compile(ast.Module([node], []), node.name, "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_offload_embedding_hooks.py :19
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_offload_tied_autodisable.py :49
exec(ast.get_source_segment(_SRC, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_offload_tied_guard.py :19
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_peft_stale_torchao.py :99
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_raw_text_json_loading.py :25
exec( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_sft_vision_dataset_gate.py :32
exec(ast.get_source_segment(src, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_st_save_merged_signature.py :126
exec(ast.get_source_segment(src, node[0]), ns) - dynamic code execution __import__ sink abhishekpandaOfficial-XOne-7867e6d/tests/test_st_save_merged_signature.py :141
"os": __import__("os"), - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_studio_root_resilience.py :120
exec(helper, ns) # noqa: S102 -- defines _resolved_studio_root_and_is_legacy - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_tool_mask_zoo_compat.py :55
exec(textwrap.dedent(function_src), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_torchao_torch_symbol_skew.py :212
exec(line, {}) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_unsloth_device_map_optin.py :71
exec(ast.get_source_segment(_SRC, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_unsloth_device_map_platform_matrix.py :151
exec(ast.get_source_segment(_SRC, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_unsloth_device_map_review_fixes.py :98
exec(ast.get_source_segment(_SRC, node), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_version_single_source.py :128
exec(compile(body, "main.py", "exec"), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_video_path_validation.py :39
exec(compile(mini, str(source_path), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/test_warnings_issued_guard.py :62
exec(compile(ast.Module(body = wanted, type_ignores = []), str(SRC_PATH), "exec"), ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/utils/test_dataset_num_proc.py :517
return eval( # noqa: S307 - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/utils/test_truncation_attestation.py :57
exec(compile(ast.Module(body = kept, type_ignores = []), str(RL_PATH), "exec"), module.__dict__) - dynamic code execution pickle.loads() abhishekpandaOfficial-XOne-7867e6d/tests/version_compat/test_trl_padding_free_max_length.py :2180
revived = pickle.loads(pickle.dumps(wrapper)) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/version_compat/test_trl_padding_free_max_length.py :3054
exec("\n".join(line[4:] for line in lines), namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/tests/version_compat/test_trl_vllm_generation_lora_patch.py :184
exec(compile(class_src, filename, "exec"), vllm_generation.__dict__) - dynamic code execution __import__() abhishekpandaOfficial-XOne-7867e6d/unsloth/dataset_num_proc.py :124
module = __import__(module_name) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/_utils.py :2085
exec(f"from {config_filepath} import {config_filename}", globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/cohere.py :509
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/falcon_h1.py :704
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/gemma.py :416
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/gemma2.py :574
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/granite.py :534
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/llama.py :2324
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/loader_utils.py :526
exec(new_mapper, namespace) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/mistral.py :451
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/qwen2.py :49
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/qwen3.py :390
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/qwen3_moe.py :177
exec(function, globals()) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/rl.py :2127
trainer = eval(f"trl.trainer.{trainer_file}") - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/rl_replacements.py :3259
exec(compile(src, "<unsloth>", "exec"), openenv_utils.__dict__, local_ns) - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/models/vision.py :1158
if eval(_dtype) is not None: - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/save.py :1247
proj = eval(f"layer.{item}") - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/tokenizer_utils.py :157
FastTokenizer = eval( - dynamic code execution eval()/exec() abhishekpandaOfficial-XOne-7867e6d/unsloth/trainer.py :1014
exec( - suspicious endpoint 169.254.169.254 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_gemini_provider.py :1629
"https://169.254.169.254/latest/meta-data", - suspicious endpoint 64.227.100.5 abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_lan_access_settings.py :327
assert status["public_urls"] == ["http://64.227.100.5:8888"] - suspicious endpoint 169.254.169.254 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_permission_mode.py :2465
{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}, - suspicious endpoint 169.254.169.254 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_provider_base_url_validation.py :402
"http://169.254.169.254/latest/meta-data/iam/security-credentials/", - suspicious endpoint 100.100.100.200 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_provider_base_url_validation.py :410
"http://100.100.100.200/latest/meta-data/", - suspicious endpoint 1.1.1.1 abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_provider_base_url_validation.py :474
assert validate_provider_base_url("https://1.1.1.1/v1") == "https://1.1.1.1/v1" - suspicious endpoint 169.254.169.254 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_sandbox_tools.py :32
'import requests; requests.get("http://169.254.169.254/latest/meta-data/")', - suspicious endpoint 169.254.169.254 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_youtube_transcript.py :169
f"https://169.254.169.254/api/timedtext?v={VIDEO_ID}", - suspicious endpoint 169.254.169.254 (cloud metadata) abhishekpandaOfficial-XOne-7867e6d/tests/security/test_scan_npm_packages.py :491
url = "fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/role',\n" - committed secret OpenAI key abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_debug_log_redaction.py :112
sk-9f8…(29 chars, redacted) - committed secret GitHub fine-grained PAT abhishekpandaOfficial-XOne-7867e6d/studio/backend/tests/test_llama_cpp_start_failure_classification.py :991
github…(40 chars, redacted) - committed secret HuggingFace token abhishekpandaOfficial-XOne-7867e6d/tests/studio/test_autoload_hf_token_preflight.py :120
hf_sta…(33 chars, redacted)
[](https://mcpobservatory.com/servers/github:abhishekpandaOfficial/XOne/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of abhishekpandaOfficial.