hf-mcp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path hub_repo_details(..., include_readme=true) (and similarly model_search/dataset_search when it returns repo metadata) can fetch and ingest outsider-authored README/model card text from the public Hugging Face Hub into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime fetches from the Hugging Face Hub (e.g., hf_doc_fetch(doc_url="https://huggingface.co/docs/peft/...") and hub_repo_details(..., include_readme=true)) and dynamic_space/hf_jobs invocations that execute remote Spaces or pull container images, so external content can directly control agent instructions or run remote code.