huggingface-datasets

SUSPICIOUS. The core Dataset Viewer API guidance is benign and uses official Hugging Face endpoints, but the skill’s footprint exceeds its stated read-only exploration purpose by including upload workflows—especially uploading raw agent trace directories from local machines. No clear malware or credential-harvesting behavior is present, yet the scope expansion and remote transfer of sensitive local data make the skill medium risk overall.