The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to read the Hugging Face authentication token from a specific filesystem path (~/.cache/huggingface/token) using shell commands to authenticate API requests.
[COMMAND_EXECUTION]: The workflow relies on executing shell commands, including curl, jq, and the hf CLI tool, to interact with external services and process retrieved data.
[EXTERNAL_DOWNLOADS]: Fetches benchmark data, dataset metadata, and model information from official Hugging Face API endpoints as part of the model selection process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes model descriptions and benchmark data from external API responses, creating an attack surface for instructions embedded in data.
Ingestion points: Model metadata and dataset descriptions retrieved from huggingface.co (SKILL.md).
Boundary markers: Includes explicit instructions in the Anti-Patterns section to avoid treating external content as trusted instructions.
Capability inventory: Access to shell commands for network requests and data processing.
Sanitization: Relies on instructional guardrails rather than automated sanitization or schema validation of retrieved external text.

huggingface-best