The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates the installation of the Hugging Face CLI by fetching and executing a setup script from the official hf.co domain (curl -LsSf https://hf.co/cli/install.sh | bash -s).
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the hf-mount utility by downloading a script from the Hugging Face organization's official GitHub repository (https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh).
[COMMAND_EXECUTION]: The tool includes a feature (hf extensions install REPO_ID) that allows the agent to install additional functionality from public GitHub repositories.
[DATA_EXFILTRATION]: While intended for legitimate use, the skill provides access to sensitive authentication tokens through commands like hf auth token and hf auth login, and manages environment variables like HF_TOKEN. This capability allows the agent to read and handle user credentials for the Hugging Face Hub.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data (such as repository IDs and academic paper IDs) and has broad capabilities including file writes, network requests, and code installation. Boundary markers are absent, creating a surface for processing instructions embedded in Hub content.

hf-cli