The Agent Skills Directory

[SAFE]: The skill provides explicit warnings against hardcoding authentication tokens, recommending the use of environment variables or secret managers for HF_TOKEN instead. It directs users to the official Hugging Face settings page for token generation.
[SAFE]: The skill correctly identifies the risks associated with the trust_remote_code=True parameter in Transformers, advising users to only enable it for reviewed code and to use immutable commit hashes (revision) to prevent supply-chain attacks.
[SAFE]: Recommendations for model saving and loading focus on safetensors, which is a security-oriented alternative to the unsafe Python pickle format. The documentation correctly notes that legacy pickle-based loading is a security risk.
[SAFE]: Dependencies are pinned to specific versions (e.g., transformers==5.18.0, torch==2.14.1) and installation instructions use standard package managers like uv or pip targeting official registries.
[SAFE]: All external references for documentation, migration guides, and source code review point to official Hugging Face or established open-source repositories (e.g., GitHub, PyPI, arXiv).

transformers