hf-cli
Warn
Audited by Snyk on Jul 8, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill includes installation commands that fetch and execute remote scripts (curl -LsSf https://hf.co/cli/install.sh | bash -s at SKILL.md:1 and curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh at SKILL.md:173) and also exposes a runtime command that can run a script from a URL (hf jobs uv run SCRIPT at SKILL.md:109-111), which is high-risk because it executes remote code.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata