hf-cli
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Remote Script Installation: The skill references an installation command that fetches and executes a shell script from the vendor's domain (hf.co). This is a standard practice for CLI tool distribution.
- External Extension Support: The hf extensions install command allows for the installation of additional functionality from public GitHub repositories. The ability to download and execute external code is a significant security consideration.
- Remote Code and Sandbox Execution: Commands within the hf jobs and hf sandbox groups allow for running scripts, including those from remote URLs, and managing code execution within remote virtual environments.
- Authentication and Secret Handling: The skill provides commands to manage access tokens and environment variables. These functions are essential for Hub operations but involve the management of sensitive credentials.
- Indirect Prompt Injection Surface: The skill can ingest data from the Hugging Face Hub, such as model cards or research papers, which could potentially contain instructions aimed at influencing the agent's behavior. Ingestion points: Data is retrieved via commands like hf papers read, hf models card, and hf datasets card. Boundary markers: Explicit delimiters for external content are not defined in the skill instructions. Capability inventory: The skill provides access to a wide range of system and network capabilities through the CLI tool. Sanitization: There are no specified mechanisms for validating or sanitizing the content retrieved from the Hub.
Audit Metadata