hf-cli
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Installation from Official Source: The skill provides a command to install the
hfCLI usingcurl -LsSf https://hf.co/cli/install.sh | bash. This follows a common installation pattern for developer tools and fetches the script directly from the official Hugging Face domain. - Extension Management Capabilities: The
hf extensions installcommand allows for the installation of additional functionality from public GitHub repositories. This is a core feature of the CLI that enables extensibility by fetching and executing external code as defined by the user. - Remote Script Execution on Infrastructure: The commands
hf jobs uv runandhf jobs scheduled uv runallow users to execute scripts, provided via local paths or URLs, on Hugging Face's remote infrastructure. This functionality is intended for distributed compute tasks and allows the agent to trigger remote code execution. - Authentication and Token Management: The skill includes a suite of commands under
hf authfor managing user access tokens. These tools allow for logging in, switching accounts, and listing active tokens, which are necessary for interacting with private repositories and performing authenticated actions on the Hub. - Data Querying via SQL: The
hf datasets sqlcommand permits the execution of SQL queries against dataset parquet files using DuckDB. This provides a structured way to interact with and process remote data directly from the CLI environment.
Audit Metadata