hf-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides tools such as
hf_jobsthat allow for the execution of arbitrary Python scripts (usinguv) and containerized commands (e.g.,pip installfollowed by script execution) on Hugging Face's remote compute infrastructure. - [EXTERNAL_DOWNLOADS]: The skill fetches documentation, repository details, and README files from the Hugging Face Hub (
huggingface.co). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content retrieved from the Hugging Face Hub, which presents an attack surface where malicious instructions could be embedded in repository metadata or documentation to influence subsequent agent actions.
- Ingestion points: External data enters the agent context through tools like
hub_repo_details,hf_doc_fetch, and various search functions. - Boundary markers: The instructions do not specify the use of technical delimiters or markers to isolate the content fetched from the Hub from the agent's core instruction set.
- Capability inventory: The agent has access to powerful capabilities including remote job execution (
hf_jobs) and dynamic space invocation (dynamic_space). - Sanitization: There is no mention of sanitizing or filtering the fetched documentation or README content before it is parsed by the agent.
Audit Metadata