huggingface-tool-builder
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious behavior, obfuscation, or unauthorized data access was detected across the skill files or reference scripts.
- [EXTERNAL_DOWNLOADS]: Interacts with Hugging Face (huggingface.co) to retrieve model metadata and cards. This is a well-known service and the operations are consistent with the skill's documented purpose.
- [COMMAND_EXECUTION]: Employs standard utilities like curl, jq, and the hf CLI for API interaction. These commands are used safely and rely on an environment variable for authentication.
- [DATA_EXFILTRATION]: Authentication is handled via the HF_TOKEN environment variable as a standard security practice. The skill does not hardcode credentials or transmit sensitive information to untrusted domains.
Audit Metadata