hf-mem
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads and executes the hf-mem package using uvx from its official repository.
- [COMMAND_EXECUTION]: Executes shell commands via uvx to perform memory estimation for model weights, which is the primary intended behavior of the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill takes untrusted user input such as model identifiers and file paths and places them into shell command arguments.
- Ingestion points: User-provided and parameters in SKILL.md.
- Boundary markers: Lacks explicit delimiters for input interpolation in the command examples.
- Capability inventory: Shell command execution via the uvx tool (SKILL.md).
- Sanitization: Provides instructional guidance for the agent to quote inputs to mitigate command injection risks.
Audit Metadata