huggingface

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides standard documentation and code examples for machine learning development using established libraries such as transformers, torch, and datasets. All analyzed content is consistent with its stated educational purpose.
  • [EXTERNAL_DOWNLOADS]: The skill includes examples that fetch models and datasets from well-known services and organizations, including Meta (meta-llama) and the Allen Institute for AI (allenai). These references use official library APIs and represent standard development workflows.
  • [CREDENTIALS_SAFE]: The documentation includes a security best practice section that explicitly warns against hardcoding Hugging Face access tokens in code, recommending safer alternatives like environment variables or CLI-based authentication.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting and processing external data, which is an inherent feature of ML inference tools. While this creates an attack surface, the risk is inherent to the tool's primary purpose.
  • Ingestion points: Text inputs to classifier() and iteration over samples in load_dataset() in SKILL.md.
  • Boundary markers: None present in the code examples to delimit external data.
  • Capability inventory: Model inference and dataset streaming functionalities described in SKILL.md.
  • Sanitization: No explicit input sanitization or validation is demonstrated in the quick-start examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 03:36 AM