hugging-face-trackio
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
trackioandhuggingface-hubpackages via standard package managers (pip/uv). - Evidence:
pip install trackioanduv pip install trackioinreferences/logging_metrics.md. - Evidence: Metadata in
SKILL.mdspecifies installation ofhuggingface-hubusinguv. - Source Verification: The packages originate from Hugging Face and the
gradio-apporganization, which are well-known and trusted technology entities. - [COMMAND_EXECUTION]: The skill utilizes a CLI interface (
trackio) to manage projects and retrieve training data. - Evidence: Documentation in
references/retrieving_metrics.mddetails various subcommands likelist projects,get metric, andsync. - Scope: The commands are restricted to managing experiment metadata and do not involve arbitrary shell execution or dangerous privilege escalation.
- [DATA_EXFILTRATION]: The skill supports syncing experiment metrics to Hugging Face Spaces.
- Evidence:
trackio.init(space_id="...")andtrackio synccommands. - Intent: This is the primary intended functionality of the skill for remote monitoring and persistence, targeting the user's own infrastructure on a well-known service.
Audit Metadata