huggingface-spaces

SUSPICIOUS: the skill is mostly aligned with its stated Hugging Face Spaces purpose and uses largely official first-party data flows, but it expands trust in two notable ways: transitive installation of another skill and optional use of third-party wheel artifacts hosted under a non-official namespace. Credentials flow to official HF services rather than an intermediary, so this is not strongly indicative of malware, but the account-impacting actions and supply-chain exposure make it a medium-risk skill.