hugging-face
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@useclawlink/clipackage from the NPM registry. This is a standard method for accessing the vendor's command-line tools. - [COMMAND_EXECUTION]: The instructions require the agent to execute shell commands to manage authentication and interact with Hugging Face via the CLI.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Hugging Face APIs, such as dataset contents or research paper metadata, which are provided to the agent as text.
- Ingestion points: Outputs from Hugging Face actions executed via
npx @useclawlink/cli(referenced inSKILL.md). - Boundary markers: The skill does not define specific delimiters for external data.
- Capability inventory: Shell command execution via the vendor CLI.
- Sanitization: Not explicitly implemented in the skill instructions.
Audit Metadata