skills/huggingface/skills/hf-cli/Socket

hf-cli

Warn

Audited by Socket on Sep 25, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill mostly aligns with its stated purpose as an official Hugging Face CLI wrapper, and the documented installer/release sources are same-org and verifiable. However, it has meaningful security risk from official-but-unpinned curl|bash installation, broad operational scope with destructive and cloud-deployment actions, and transitive trust through skill/extension installation from external repos. Not malware, but higher-risk than a narrow documentation-only skill.

Confidence: 92%Severity: 56%

Audit Metadata

Analyzed At

Sep 25, 2026, 12:39 PM

Package URL

pkg:socket/skills-sh/huggingface%2Fskills%2Fhf-cli%2F@a4f968f9d6fcfbde05feaab0f2bab63daa2b89de3542cc4b083876f632f27339