hugging-face-cli

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Fetches and executes setup scripts from official Hugging Face infrastructure. The documentation includes commands for installing the hf CLI tool (https://hf.co/cli/install.sh) and the hf-mount utility (https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh). Both commands follow a pattern of downloading the script to a temporary directory, offering the user a chance to review it via less, and then performing execution via bash or sh.- [COMMAND_EXECUTION]: Defines extensive CLI capabilities for interacting with the Hugging Face platform. This includes hf jobs run and hf jobs scheduled uv run for executing code on remote infrastructure, and hf extensions install for adding tool functionality from GitHub repositories.- [DATA_EXFILTRATION]: Documents commands for managing platform authentication, including hf auth login for credential storage and hf auth token for retrieving the current access token. These are standard administrative functions for the described service and do not represent unauthorized exfiltration.
Recommendations
  • INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 12:21 PM
Security Audit — agent-trust-hub — hugging-face-cli