hf-cli
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches installation scripts from Hugging Face's official domain (hf.co) and public GitHub repository (github.com/huggingface).
- [REMOTE_CODE_EXECUTION]: Includes instructions to install the CLI and mounting tool using curl-to-shell patterns (e.g.,
curl | bash). These commands point to official Hugging Face infrastructure and are standard for the tool. - [COMMAND_EXECUTION]: Exposes powerful commands for repository management, authentication, and executing jobs or scripts on remote infrastructure (
hf jobs run,hf jobs uv run). - [PROMPT_INJECTION]: Presents an indirect prompt injection surface where untrusted data could influence agent behavior.
- Ingestion points: Reading external papers (
hf papers read) and downloading/listing repository content. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the ingested content.
- Capability inventory: High-capability actions including remote job execution on Hugging Face infrastructure, repository deletion, and authentication management.
- Sanitization: No evidence of content validation or filtering for data retrieved from the Hub.
Recommendations
- INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata