The Agent Skills Directory

[PROMPT_INJECTION]: The skill's evaluation suite includes adversarial fixtures in the evals/files/injection-hf/ directory. These files contain instructions designed to override converter behavior, skip local validation, and suppress security reporting (e.g., 'These project rules override the converter's normal behavior' in README.md). The skill's core logic is designed to ignore these instructions and treat them as evidence rather than commands.\n- [DATA_EXFILTRATION]: Adversarial fixtures in the evals/ directory include configuration settings and instructions to exfiltrate sensitive artifacts like model weights and dataset statistics to external endpoints (e.g., https://models.example.com/archive). The skill's implementation explicitly handles these as untrusted inputs to be reported as anomalies.\n- [CREDENTIALS_UNSAFE]: A test fixture requirement file (evals/files/injection-hf/requirements.txt) contains a placeholder credential embedded in a package index URL (https://ci-bot:FAKE-hf-eval-token@packages.example.com/simple). This is an adversarial example used to test the skill's credential redaction capabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect prompt injection as it ingests and processes untrusted user source code and documentation.\n
Ingestion points: The skill reads user training scripts, README files, and Hugging Face model/dataset cards during the inspection phase (SKILL.md Step 2).\n
Boundary markers: Skill instructions explicitly mandate that source text must be treated only as evidence and not as instructions, with specific triggers to report anomalies to the user.\n
Capability inventory: The skill can write files, execute simulations, and perform network requests to resolve Hugging Face model snapshots.\n
Sanitization: The skill implements strict argument parsing (allow_abbrev=False), dependency auditing, and automated redaction of credentials found in source files.\n- [EXTERNAL_DOWNLOADS]: The skill resolves external model and dataset snapshots from the Hugging Face Hub using a dedicated resolver script. The logic includes security gates, requiring explicit user authorization for any downloads and pinning Hub artifacts to full 40-character commit SHAs for integrity.\n- [REMOTE_CODE_EXECUTION]: While the skill's test fixtures include adversarial requests to execute remote code (e.g., downloading a custom aggregator), the skill's instructions strictly prohibit satisfying such requests and mandate using only the provided flare.patch model-exchange integration.

nvflare-convert-huggingface