huggingface-llm-trainer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly instructs including the user's HF_TOKEN via patterns like secrets={"HF_TOKEN": "$HF_TOKEN"} and states that "$HF_TOKEN" references the actual token value, which requires the agent to insert/handle the secret verbatim (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/dataset_inspector.py, the required workflow calls the Datasets Server API for the user-specified --dataset/--split and prints/returns example field values and “MAPPING CODE”, so outsider-authored dataset text can be ingested and echoed back into free text at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The convert_to_gguf job script (scripts/convert_to_gguf.py) clones and builds the llama.cpp repository at runtime from https://github.com/ggerganov/llama.cpp.git which fetches and executes remote code required for conversion.