The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides Python examples using the trust_remote_code=True parameter within the Hugging Face from_pretrained method. This setting allows the execution of custom code provided by a model's author on the Hugging Face Hub. While common for specific model architectures, it introduces a potential attack vector for arbitrary code execution if used with models from untrusted repositories.
[COMMAND_EXECUTION]: The installation section instructs users to execute several shell commands to install Python dependencies such as transformers, torch, and peft via pip. These are standard packages for the intended functionality.
[PROMPT_INJECTION]: The skill describes methods for processing user-provided messages through LLM pipelines. This capability creates an attack surface for indirect prompt injection, where malicious instructions hidden in input data could influence the behavior of the agent. The provided examples do not include sanitization or boundary markers for these inputs.

huggingface-transformers