skills/eugenepyvovarov/mcpbundler-agent-skills-marketplace/hugging-face-model-trainer/Gen Agent Trust Hub
hugging-face-model-trainer
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes the
hf_jobs()MCP tool to execute training scripts in a remote, ephemeral environment, which is the standard and intended operation of the Hugging Face Jobs platform. - [SAFE]: External dependencies and remote scripts are exclusively sourced from trusted organizations such as Hugging Face and established open-source projects like llama.cpp.
- [SAFE]: Secret management follows security best practices by instructing the agent to handle the Hugging Face authentication token (
HF_TOKEN) as a job secret, preventing credential exposure in logs or local files. - [SAFE]: The inclusion of a dataset validation tool (
scripts/dataset_inspector.py) provides a proactive security measure to verify external data formats and mitigate failures before initiating resource-intensive operations. - [SAFE]: Shell command execution in
scripts/convert_to_gguf.pyis restricted to legitimate environment setup (installing build tools) and the model conversion pipeline, using safe execution patterns without shell interpolation.
Audit Metadata