fix: remove unsafe exec() in TransferLearningTF.ipynb

[orbisai0security]

Summary

Fix critical severity security issue in lessons/4-ComputerVision/08-TransferLearning/TransferLearningTF.ipynb.

Vulnerability

Field	Value
ID	V-003
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-003
File	lessons/4-ComputerVision/08-TransferLearning/TransferLearningTF.ipynb:501
CWE	CWE-502

Description: The repository uses ML libraries (Keras, gensim, scikit-image) that rely on Python's pickle format for model serialization and deserialization. Python pickle is inherently unsafe: deserializing a pickle file executes arbitrary Python code embedded in the file. The notebooks load pre-trained model weights from external internet sources (Keras application weights, Huggingface Hub) without any integrity verification such as SHA-256 checksum validation. If an attacker can substitute a malicious model file — through a compromised download source, a man-in-the-middle attack, or by convincing a user to load an attacker-provided file — arbitrary code executes with the full privileges of the user running the notebook.

Changes

• lessons/4-ComputerVision/08-TransferLearning/TransferLearningTF.ipynb

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security