skills/jarmen423/skills/hf-cli/Socket

hf-cli

Warn

Audited by Socket on May 20, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The core Hugging Face CLI functionality is coherent and uses official Hugging Face auth/data paths, so this is not malware. However, the skill carries medium security risk from official-but-unsafe pipe-to-shell installers, token/secret handling, high-impact admin actions, and especially transitive trust via GitHub extensions and Hugging Face skill installation.

Confidence: 90%Severity: 62%

Audit Metadata

Analyzed At

May 20, 2026, 05:49 PM

Package URL

pkg:socket/skills-sh/jarmen423%2Fskills%2Fhf-cli%2F@af9b19ec53823c0f67b0084eea6bdf72e6a653a3