The Agent Skills Directory

[External Model Downloads]: The skill is designed to download machine learning model weights from the Hugging Face Hub at runtime.
This is the primary mechanism for acquiring model weights and is documented as a standard feature.
Configuration options are provided in references/CONFIGURATION.md to disable remote downloads (env.allowRemoteModels = false) and use local files instead, which is a recommended practice for restricted environments.
[Secure Credential Management]: The library provides standardized methods for handling authentication tokens when accessing private or gated models.
Instructions in references/CONFIGURATION.md describe using environment variables ($HF_TOKEN) or dynamically injecting headers via a custom fetch wrapper.
The documentation specifically warns against hard-coding credentials in client-side code, aligning with security best practices.
[Indirect Prompt Injection Surface]: As a machine learning inference library, this skill provides tools to process untrusted data from external sources.
Ingestion points: Untrusted text, audio, and image data are ingested through the pipeline() interface, as demonstrated in the examples within SKILL.md and references/TASKS.md.
Boundary markers: The skill documentation does not explicitly define prompt boundaries or specific instructions to ignore embedded commands within user-provided data.
Capability inventory: The library has the capability to perform network requests via fetch, load and execute models using WebAssembly (WASM) or WebGPU, and cache files on the local file system when running in Node.js.
Sanitization: The library itself does not include built-in sanitization for inputs or outputs; developers are encouraged to handle model outputs with care when integrating them into security-sensitive applications.
[WASM and WebGPU Execution]: The skill utilizes WebAssembly and WebGPU for model inference.
These are established high-performance execution environments for the browser and Node.js, used here to ensure cross-platform compatibility and performance for machine learning tasks.

transformers-js