hugging-face-trackio

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the trackio and huggingface-hub packages via standard package managers (pip/uv).
  • Evidence: pip install trackio and uv pip install trackio in references/logging_metrics.md.
  • Evidence: Metadata in SKILL.md specifies installation of huggingface-hub using uv.
  • Source Verification: The packages originate from Hugging Face and the gradio-app organization, which are well-known and trusted technology entities.
  • [COMMAND_EXECUTION]: The skill utilizes a CLI interface (trackio) to manage projects and retrieve training data.
  • Evidence: Documentation in references/retrieving_metrics.md details various subcommands like list projects, get metric, and sync.
  • Scope: The commands are restricted to managing experiment metadata and do not involve arbitrary shell execution or dangerous privilege escalation.
  • [DATA_EXFILTRATION]: The skill supports syncing experiment metrics to Hugging Face Spaces.
  • Evidence: trackio.init(space_id="...") and trackio sync commands.
  • Intent: This is the primary intended functionality of the skill for remote monitoring and persistence, targeting the user's own infrastructure on a well-known service.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 05:09 AM
Security Audit — agent-trust-hub — hugging-face-trackio