hugging-face-tool-builder
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's behavior is consistent with its stated purpose of building Hugging Face API tools.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs the use of the
HF_TOKENenvironment variable for authentication rather than hardcoding credentials. This follows best practices for secret management. - [EXTERNAL_DOWNLOADS]: The skill installs the
huggingface-hublibrary and downloads data (model cards and metadata) fromhuggingface.co. These are interactions with a well-known service and do not represent a security risk. - [COMMAND_EXECUTION]: The skill includes reference scripts that execute local shell, Python, and TSX commands. These scripts are used for data parsing and API interaction and do not perform unauthorized or dangerous operations.
- [DATA_EXFILTRATION]: Network activity is restricted to the Hugging Face API (
huggingface.co), which is necessary for the skill's functionality. No evidence of data being sent to unauthorized third-party domains was found.
Audit Metadata