huggingface-vision-trainer
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses established platform mechanisms (Hugging Face Jobs and Secrets) for authentication and remote execution. No hardcoded credentials or unauthorized data exfiltration patterns were found. It correctly instructs the agent to use standard platform variables ($HF_TOKEN) rather than requesting manual entry or exposure of secrets.
- [SAFE]: External dependencies are restricted to well-known machine learning libraries (Transformers, PyTorch, Albumentations, etc.) and established experiment tracking tools (Trackio) that integrate with the user's own Hugging Face workspace.
- [SAFE]: The dataset inspection and training logic communicate exclusively with official Hugging Face domains (huggingface.co, datasets-server.huggingface.co), which are recognized as well-known and trusted services for this use case.
- [SAFE]: No obfuscation, privilege escalation, or persistence mechanisms were detected. The scripts are atomic, self-contained, and use PEP 723 inline metadata for dependency management, ensuring a reproducible and verifiable execution environment.
Audit Metadata