hf-mcp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs including an HF_TOKEN in a job's "secrets" payload (e.g., secrets: {"HF_TOKEN": "$HF_TOKEN"}), which implies the agent will inject a secret value into generated requests/commands and thus risks exposing the secret verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow uses Hugging Face Hub/MCP tools like hub_repo_details(..., include_readme=true) and hf_doc_fetch(...), which at runtime fetch outsider-authored README/docs/free text from public Hugging Face pages and inject that readable text into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The example call hf_doc_fetch(doc_url="https://huggingface.co/docs/peft/...") (line SKILL.md:69) indicates the skill can fetch remote documentation at runtime and inject that content into the agent's context, which could directly control prompts or instructions.