The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs the hf_jobs tool and the HfApi().run_uv_job() method to submit Python training scripts to cloud-managed GPUs. These scripts are saved in a local submitted_jobs/ directory before being transferred for remote execution on the Hugging Face Jobs infrastructure.
[EXTERNAL_DOWNLOADS]: The scripts/dataset_inspector.py script communicates with datasets-server.huggingface.co to retrieve dataset metadata and example rows. This involves interaction with official Hugging Face APIs, which is a standard procedure using a well-known service.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection due to its core functionality of processing external data.
Ingestion points: External datasets are loaded at runtime in scripts/object_detection_training.py, scripts/image_classification_training.py, and scripts/sam_segmentation_training.py using the load_dataset function.
Boundary markers: The instructions and training scripts do not implement specific boundary markers or instructions to disregard potential commands hidden within dataset labels, categories, or other metadata.
Capability inventory: The skill can perform file system writes (saving models and checkpoints) and network operations (pushing model files and image processors to the Hub via Trainer.push_to_hub()).
Sanitization: A sanitize_dataset function is present in scripts/object_detection_training.py to validate and clip bounding box coordinates, providing some protection against malformed geometric data, though it does not cover other metadata fields.
[SAFE]: Authentication is managed securely through environment variables and platform-native secret injection. The skill provides clear guidance on using the HF_TOKEN correctly within the Hugging Face ecosystem, avoiding hardcoded credentials and unsafe token storage.

huggingface-vision-trainer