hugging-face-jobs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow can ingest outsider-authored free text from a user-specified Hugging Face dataset (e.g., load_dataset(args.seed_dataset, split="train") / load_dataset(src_dataset_hub_id, split="train")), then turns those dataset fields into prompts that are fed into the LLM via llm.generate(...) / tokenizer.apply_chat_template(...).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly allows and examples show using remote script URLs (e.g., https://huggingface.co/datasets/uv-scripts/synthetic-data/raw/main/cot-self-instruct.py and https://raw.githubusercontent.com/huggingface/trl/main/trl/scripts/sft.py) as the hf_jobs("uv", {"script": ""}) input, which will be fetched at runtime and executed as code (thus directly controlling the job's behavior); this is high-confidence evidence of runtime-executed external code.