huggingface-tool-builder
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of command-line tools such as
curl,jq, and thehfCLI. These are used as intended for querying API endpoints, downloading public model metadata, and processing JSON data. - [DATA_EXPOSURE]: The skill encourages the use of
HF_TOKENvia an environment variable. This is a standard and recommended practice for secret management in CLI tools to avoid hardcoding credentials. The scripts handle the token locally to authorize API requests tohuggingface.co. - [EXTERNAL_DOWNLOADS]: The skill downloads content from
huggingface.co, which is a well-known service for AI models and datasets. These downloads (API responses, model cards) are necessary for the skill's primary purpose. - [DYNAMIC_EXECUTION]: One reference script (
hf_model_card_frontmatter.sh) uses a Python heredoc to parse YAML frontmatter. This is a static script pattern used for local processing of downloaded metadata and does not execute untrusted remote code.
Audit Metadata