skills/eugenepyvovarov/mcpbundler-agent-skills-marketplace/hugging-face-evaluation/Gen Agent Trust Hub
hugging-face-evaluation
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Multiple scripts utilize the
subprocessmodule to execute established command-line tools for model evaluation and job management. - Evidence:
scripts/inspect_eval_uv.pyandscripts/inspect_vllm_uv.pyexecute theinspectcommand from theinspect-aiframework. - Evidence:
scripts/lighteval_vllm_uv.pyexecutes thelightevalcommand. - Evidence:
scripts/run_eval_job.pyandscripts/run_vllm_eval_job.pyutilize thehfCLI for job submission and management on Hugging Face infrastructure. - [EXTERNAL_DOWNLOADS]: The skill interacts with well-known technology services to fetch and update model metadata and benchmarks.
- Evidence: Uses the
huggingface-hublibrary to load README content and push evaluation results to model cards on Hugging Face. - Evidence: Fetches benchmark data from the Artificial Analysis API (
artificialanalysis.ai) using therequestslibrary. - [REMOTE_CODE_EXECUTION]: The evaluation scripts include support for the
trust_remote_codeparameter, a standard feature in the Hugging Face ecosystem that allows executing custom model code provided in a repository. - Evidence:
scripts/inspect_vllm_uv.py,scripts/lighteval_vllm_uv.py, andscripts/run_vllm_eval_job.pyallow users to enable this flag for models that require it. - [PROMPT_INJECTION]: The skill processes untrusted content from model READMEs which represents a surface for indirect prompt injection, though it uses structured parsing to mitigate risk.
- Ingestion points:
scripts/evaluation_manager.pyreads README content from various Hugging Face repositories. - Boundary markers: The skill does not use explicit boundary markers when processing README text.
- Capability inventory: The skill can update model cards (
push_to_hub) and create pull requests on the Hugging Face Hub. - Sanitization: It uses the
markdown-it-pylibrary for structured table parsing and validates extracted numeric scores before processing.
Audit Metadata