hugging-face
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and runs the
@useclawlink/clipackage from the official NPM registry usingnpx. This is the documented and intended method for using the vendor's integration tools. - [COMMAND_EXECUTION]: The skill utilizes shell commands (
npx @useclawlink/cli) to perform authentication, action discovery, and execution of Hugging Face tasks. These commands are necessary for the skill's primary functionality. - [DATA_EXPOSURE]: The skill identifies that credentials are saved to
~/.clawlink/credentials.jsonby the CLI login process. This is a standard local storage practice for CLI tools and no instructions are present to exfiltrate or unsafely access this data.
Audit Metadata