hf-cli
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Remote Script Installation: The skill references installation commands that fetch and execute shell scripts directly from Hugging Face's official domains and GitHub repositories (
hf.coandgithub.com/huggingface). These are standard deployment methods for the CLI and its filesystem mount utility. - CLI Extension Management: The
hf extensionscommands allow for the installation and execution of external extensions from GitHub. This is a functional capability of the tool that permits dynamic code loading based on user-provided repository identifiers. - Remote Job Execution: The skill includes commands to run scripts on Hugging Face's infrastructure via
hf jobs. This allows users to execute local or remote scripts within the vendor's managed environment. - Authentication and Secret Management: The skill provides commands for managing Hugging Face access tokens (
hf auth). It correctly recommends using theHF_TOKENenvironment variable for authentication, which is a recognized best practice for securing credentials.
Audit Metadata