The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs documented command-line operations using tools like cmake, git, uv, and llama-cli. These are restricted to the local workspace and are necessary for the model conversion and validation workflow.
[EXTERNAL_DOWNLOADS]: Fetches source code and model artifacts from well-known services, specifically GitHub (github.com/ggml-org/llama.cpp) and Hugging Face (huggingface.co). All downloads are pinned to immutable revisions (git commits or SHAs) to prevent supply chain attacks.
[CREDENTIALS_UNSAFE]: The skill demonstrates excellent security posture regarding credentials. It explicitly forbids the exchange of tokens in prompts and uses local, secure configuration for Hub access. The artifact_manifest.py script includes active regex-based scanning to prevent API tokens or private keys from being included in the generated manifests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests model configuration files (e.g., config.json) which are external data. This risk is mitigated by the skill's requirement for strict architecture validation and immutable revision pinning of the source repositories, following the principle of least privilege for automated data processing.

hf-generative-model-converter