hugging-face-evaluation

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Several scripts (e.g., evaluation_manager.py, run_eval_job.py, inspect_eval_uv.py) use subprocess.run() to invoke CLI tools like inspect, lighteval, and hf jobs. These calls use list-based arguments, which is a secure implementation that prevents shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the uv tool to manage dependencies via PEP 723 script headers. The requested packages are standard, well-known machine learning and utility libraries (e.g., transformers, torch, vllm, huggingface-hub) sourced from official registries.
  • [CREDENTIALS_UNSAFE]: The skill requires sensitive tokens (HF_TOKEN, AA_API_KEY) for interacting with Hugging Face and Artificial Analysis APIs. It correctly instructs users to manage these via environment variables or .env files, which follows standard security best practices for secret management.
  • [REMOTE_CODE_EXECUTION]: The skill provides functionality to submit evaluation jobs to Hugging Face infrastructure (hf jobs). This is the primary intended purpose of the skill and uses official Hugging Face CLI tools to interact with their trusted infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 04:43 PM
Security Audit — agent-trust-hub — hugging-face-evaluation