huggingface-llm-trainer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly instructs submitting jobs with secrets={"HF_TOKEN": "$HF_TOKEN"} and explains that "$HF_TOKEN" references the actual token value, which forces the LLM/agent to handle or embed a user’s secret token value in submissions (exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Multiple URLs point to user-controlled/raw script locations and placeholder user repos (raw.githubusercontent, gist, example.com, user Hugging Face repos and resolve/raw script URLs) which, if fetched and executed, would run arbitrary untrusted code — these are higher-risk download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository contains high-risk patterns that enable remote code execution and remote operations (notably trust_remote_code=True, cloning/executing external repo scripts/binaries, and automatic Hub uploads using user HF_TOKEN), which could be abused to run attacker-controlled code or exfiltrate artifacts when jobs are submitted.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the required workflow submits user-provided training scripts via the hf_jobs() tool, where the inline script can call datasets.load_dataset() on arbitrary Hugging Face datasets and thus ingest outsider-authored free-text examples at training time.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit hf_jobs/uv run examples that pass remote script URLs (e.g., https://huggingface.co/datasets/mcp-tools/skills/raw/main/dataset_inspector.py and https://raw.githubusercontent.com/huggingface/trl/main/examples/scripts/grpo.py) and a conversion script that clones and builds a remote repo (https://github.com/ggerganov/llama.cpp.git), which will fetch and execute remote code at runtime when those examples/jobs are run.