hugging-face-evaluation
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Several scripts (e.g.,
evaluation_manager.py,run_eval_job.py,inspect_eval_uv.py) usesubprocess.run()to invoke CLI tools likeinspect,lighteval, andhf jobs. These calls use list-based arguments, which is a secure implementation that prevents shell injection. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
uvtool to manage dependencies via PEP 723 script headers. The requested packages are standard, well-known machine learning and utility libraries (e.g.,transformers,torch,vllm,huggingface-hub) sourced from official registries. - [CREDENTIALS_UNSAFE]: The skill requires sensitive tokens (
HF_TOKEN,AA_API_KEY) for interacting with Hugging Face and Artificial Analysis APIs. It correctly instructs users to manage these via environment variables or.envfiles, which follows standard security best practices for secret management. - [REMOTE_CODE_EXECUTION]: The skill provides functionality to submit evaluation jobs to Hugging Face infrastructure (
hf jobs). This is the primary intended purpose of the skill and uses official Hugging Face CLI tools to interact with their trusted infrastructure.
Audit Metadata