hf-cli
Fail
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Hugging Face CLI installation script from the official 'hf.co' domain.\n- [REMOTE_CODE_EXECUTION]: Downloads and executes the 'hf-mount' setup script directly from Hugging Face's official GitHub repository. It also enables the installation and execution of arbitrary extensions from GitHub repositories via the 'hf extensions install' command.\n- [COMMAND_EXECUTION]: Provides extensive capabilities to interact with the system and remote infrastructure, including downloading files, managing local caches, and running remote jobs on Hugging Face infrastructure.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the Hugging Face Hub.\n
- Ingestion points: Processes repo cards (READMEs), academic papers, and discussion comments from the Hub.\n
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates.\n
- Capability inventory: Possesses significant capabilities including remote job execution ('hf jobs run'), extension execution ('hf extensions exec'), and file system writes ('hf download').\n
- Sanitization: No sanitization or validation of the fetched external content is performed before it is processed by the agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://hf.co/cli/install.sh - DO NOT USE without thorough review
- INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata