skills/peachest/skills/hf-download/Socket

hf-download

Warn

Audited by Socket on Oct 16, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill’s goal is legitimate, but its preferred path depends on an unverifiable bundled executable that may receive Hugging Face credentials, and it optionally routes downloads through a non-official mirror. The scp and cleanup commands are proportionate, but install/provenance and credential-forwarding issues make the overall skill high risk.

Confidence: 90%Severity: 82%

Audit Metadata

Analyzed At

Oct 16, 2026, 10:45 AM

Package URL

pkg:socket/skills-sh/peachest%2Fskills%2Fhf-download%2F@84011ae57bb179ec133135d3d32a9f03803d90aae4f4b401e1ae5940e99c09a2