hf-model-card-research
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions to circumvent platform safety and stability guardrails, specifically the
same_tool_failure_haltmechanism, by moving execution logic to a host-side Python script run via the terminal. - [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands and Python scripts using the
terminaltool to automate data collection and file management. - [DYNAMIC_EXECUTION]: The skill provides a Python script template intended to be modified with dynamic data and executed at runtime on the host system.
- [DATA_EXPOSURE]: The provided script is configured to write data to the user's local filesystem at the specific path
~/Desktop/hf-verified-stats.mdwithout explicit user confirmation within the script logic. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from HuggingFace model cards which may contain malicious instructions.
- Ingestion points: Metadata and README content are fetched from the HuggingFace API and web view via
web_extract. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are included in the workflow.
- Capability inventory: The skill possesses the ability to execute terminal commands, perform network requests, and write to the local filesystem.
- Sanitization: No sanitization or filtering of the remote data is described before it is compiled into a report.
Audit Metadata