skills/huggingface/openenv/hf-cli/Socket

hf-cli

Warn

Audited by Socket on Jul 8, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The core purpose and capabilities are coherent for an official Hugging Face CLI skill, and the main installer is same-org documented. Risk comes from raw pipe-to-shell install patterns, optional secondary installer use, public GitHub extension installs, and especially transitive skill installation via `hf skills add`, which expands trust beyond this skill.

Confidence: 89%Severity: 62%

Audit Metadata

Analyzed At

Jul 8, 2026, 04:17 AM

Package URL

pkg:socket/skills-sh/huggingface%2Fopenenv%2Fhf-cli%2F@ecfe46f8420c711240d53607186553d4cfbda407dc6674ae3d2fd6f3640e6ea7