Hugging Face
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with official Hugging Face API endpoints (huggingface.co and api-inference.huggingface.co) to perform model discovery and inference tasks.
- [SAFE]: The setup workflow initializes a local storage directory (~/hugging-face/) with secure permissions (chmod 700 for the directory and chmod 600 for files), which is a recommended practice for protecting local application data.
- [SAFE]: Authentication is managed through the HF_TOKEN environment variable rather than hardcoded credentials, and the skill provides clear guidance on not logging or storing this token in plain text.
- [SAFE]: The use of standard system utilities like curl and jq for network requests and JSON parsing is well-defined and constrained to legitimate API interactions with a trusted service.
Audit Metadata