The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute the Hugging Face CLI installation script from https://hf.co/cli/install.sh. Hugging Face is a recognized and trusted organization, and this script is the official method for installing their command-line tools.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles authentication for Hugging Face Hub using the HF_TOKEN. The instructions consistently advise against hardcoding these credentials and instead promote the use of environment variables and secrets, which aligns with standard security best practices.
[COMMAND_EXECUTION]: The primary function of this skill is to generate and execute Python scripts for machine learning training. These scripts involve standard library usage (e.g., PyTorch, Hugging Face Transformers) and are designed to run in local or managed container environments.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests training data from external repositories on the Hugging Face Hub (e.g., in scripts/train_sentence_transformer_example.py via load_dataset).
Boundary markers: Input data is handled by standard machine learning data loaders and tokenizers, though there is no explicit sanitization for potential instructions embedded within the training text.
Capability inventory: The skill possesses the capability to write to the local filesystem (logs and model weights), perform network operations (pushing models to the Hub), and submit remote jobs.
Sanitization: Content from datasets is used directly for training without specific filtering for prompt injection patterns, representing a standard but inherent attack surface for data-driven agent tasks.

train-sentence-transformers