The Agent Skills Directory

[SAFE]: The skill facilitates interactions with the Hugging Face API, a well-known and trusted service in the AI ecosystem.
[DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration was found. The skill correctly instructs the user to use the HF_TOKEN environment variable for authentication, which is a standard security practice. All network operations in the provided scripts are directed toward official Hugging Face domains (huggingface.co).
[COMMAND_EXECUTION]: The provided reference scripts use standard system utilities like curl, jq, and the official hf CLI for data retrieval and processing. The instructions for generating scripts emphasize simple, non-destructive solutions and require testing, which aligns with safe development practices.
[REMOTE_CODE_EXECUTION]: The skill does not contain any patterns for downloading and executing arbitrary remote scripts (such as curl | bash). All processing logic is local and transparent within the reference files.
[PROMPT_INJECTION]: The skill's instructions establish a clear, functional role for the agent without attempting to override safety guidelines, ignore system prompts, or utilize adversarial role-play techniques.
[EXTERNAL_DOWNLOADS]: External data retrieval is limited to downloading model metadata and README files from Hugging Face, which is necessary for the skill's stated purpose. These operations use official APIs and tools.

hugging-face-tool-builder