huggingface-hub

SUSPICIOUS: the core Hugging Face CLI guidance is largely coherent and vendor-aligned, with official same-org install and direct official API use, so it is not malware-like. Risk comes from the curl|bash installer, unpinned package installation, and especially the built-in transitive trust features (`extensions install`, `skills add`) that can pull in third-party code or skills beyond the guide’s core purpose.