The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the local HuggingFace authentication token from the filesystem at ~/.cache/huggingface/token. This sensitive credential is then transmitted as a Bearer token in the Authorization header of network requests.
[COMMAND_EXECUTION]: The skill relies on shell command execution via curl, jq, and the hf CLI. These commands are used to read local sensitive files and perform network operations, which could be exploited if malicious data influences the command arguments.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes unvetted data from external public sources.
Ingestion points: Fetches benchmark results and model metadata from public HuggingFace APIs (e.g., /leaderboard and /api/models/ endpoints) in SKILL.md.
Boundary markers: No delimiters or specific instructions (e.g., "ignore embedded instructions") are used when these external strings are incorporated into the agent's reasoning context.
Capability inventory: The agent possesses shell execution capabilities (curl, jq, hf) and filesystem access.
Sanitization: There is no evidence of sanitization or validation performed on the fetched metadata, such as model tags or descriptions, before they are processed by the agent.

huggingface-best