The Agent Skills Directory

[Command Execution]: The skill uses shell commands (via subprocess.run and os.system) to automate the installation of Python packages and the compilation of native CUDA or C++ extensions. These operations are restricted to the local environment and are a routine requirement for high-performance ML models like TRELLIS and Hunyuan3D.
[External Resource Downloads]: The instructions guide the agent to fetch model weights and prebuilt wheels from Hugging Face and GitHub. The sources provided are either trusted organizations or established community contributors within the machine learning ecosystem, such as Stability AI and Microsoft.
[Credential Management]: Secure practices are encouraged through the use of Hugging Face Secrets for managing sensitive data like API tokens. The skill also documents the use of SSH keys for a legitimate developer mode, which is a standard platform feature.
[Indirect Prompt Injection Surface]: Like many development tools, this skill processes external data (such as reading code from repositories or downloading model metadata). This creates a potential surface for indirect prompt injection if the ingested content contains malicious instructions. However, the risk is mitigated by the skill's focus on structured deployment tasks and the use of well-known repositories.
[Development Workflow Integration]: The skill integrates with standard development tools like the hf CLI and uses secure OAuth-based authentication for user logins.

huggingface-spaces