The Agent Skills Directory

[Installation Script Pattern]: The skill documents an installation method using curl -LsSf https://hf.co/cli/install.sh | bash -s. This pattern fetches and executes a shell script from the vendor's official domain to set up the CLI environment.
[Credential Management]: The hf auth suite of commands (e.g., hf auth token, hf auth login) allows the agent to access and display sensitive authentication tokens. These capabilities are necessary for managing user accounts and repository access on the Hugging Face Hub.
[Extension Installation]: The hf extensions install command allows for the installation of additional functionality from public GitHub repositories. While this is an intended extensibility feature, it introduces a mechanism for downloading and executing third-party code.
[Remote Command Execution]: Several commands, including hf jobs run, hf sandbox exec, and hf jobs uv run, facilitate the execution of arbitrary code and commands within Hugging Face infrastructure or experimental sandboxes. These features allow for training, scheduling jobs, and running scripts in remote environments.
[Data Interaction Surface]: The skill interacts with external content through commands like hf models card, hf datasets info, and hf papers read. This data ingestion represents a potential surface for indirect prompt injection if the processed content contains instructions designed to influence the agent's behavior.
[Cloud Resource Management]: The skill provides extensive capabilities for copying, uploading, and syncing data between local systems, Hub repositories, and cloud buckets (hf cp, hf upload, hf buckets sync), which involve network operations to vendor-managed storage services.

hf-cli