huggingface-best

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to read an authentication token from a local file path (~/.cache/huggingface/token) using cat and pass it directly in the header of curl commands, which means the token passes through the context and output of the LLM.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow queries HuggingFace benchmark datasets and model leaderboards via API, ingesting model descriptions and metadata authored by third parties on the HuggingFace platform.