The Agent Skills Directory

[SAFE]: The skill implements secure secret management by instructing the agent to pass the Hugging Face token via the secrets parameter ($HF_TOKEN) rather than hardcoding it or reading it from unsafe locations.
[SAFE]: Remote code references and repository clones (e.g., llama.cpp from GitHub) target well-known technology services and trusted organizations, which are documented as safe sources.
[SAFE]: Subprocess executions in the conversion scripts are used for legitimate build and conversion tasks (using cmake, git, and pip). Commands are constructed as lists, which is a best practice to prevent command injection.
[SAFE]: Network operations are limited to official Hugging Face Hub APIs for dataset metadata retrieval and model management.
[SAFE]: The skill provides clear guidance on dataset validation using the dataset_inspector.py script, reducing the risk of runtime failures during expensive GPU jobs.
[SAFE]: No evidence of prompt injection, data exfiltration, obfuscation, or persistence mechanisms was found during analysis.

huggingface-llm-trainer