huggingface-lora-space-builder
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- Hugging Face Token Management: The skill requests a Hugging Face access token with write scope to enable repository creation and file uploads. This is a standard authentication requirement for interacting with the Hugging Face Hub API and includes guidance on secure token management through environment variables and Space secrets.
- Trusted External Dependencies: The skill identifies and lists necessary Python dependencies for the generated application, including packages from the author's own organization and other well-known technology providers. These are used to ensure the generated ML pipeline functions correctly.
- Command Execution for Verification: A "Smoke-test" phase involves using the Gradio CLI to verify the functionality of the published Space. This local command execution is used to validate the deployment before finalizing the process.
- Dynamic UI Generation: The skill provides guidance for generating custom HTML and JavaScript components within the Gradio application. This allows for specialized user interactions that are not available through standard components, following established Gradio patterns.
- Input Modification Considerations: To improve user experience, the skill may configure the generated application to automatically prepend trigger words to user prompts. This functional feature for LoRA models involves automated input modification that is documented as part of the UI design process.
- Data Handling Surface: The skill ingests data from public or private Hugging Face repositories to inform the application design. It uses standard SDKs to process this information and incorporates it into the generated code and configuration files.
Audit Metadata