hugging-face-cli
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download installation scripts for the Hugging Face CLI and hf-mount utility from official domains, specifically hf.co and raw.githubusercontent.com/huggingface.
- [REMOTE_CODE_EXECUTION]: The installation process involves executing downloaded shell scripts using bash and sh. Additionally, commands like
hf jobs uv runandhf jobs runfacilitate the execution of scripts or containerized images on Hugging Face infrastructure. - [COMMAND_EXECUTION]: The skill acts as a wrapper for the
hfcommand-line utility, enabling a wide range of subcommands for repository management, environment inspection, and filesystem mounting. - [CREDENTIALS_UNSAFE]: The skill includes subcommands for managing authentication tokens, such as
hf auth login,hf auth list, andhf auth token, which are standard features for the tool's intended purpose of interacting with the Hugging Face Hub. - [DATA_EXFILTRATION]: The utility provides capabilities to upload local files and folders to remote Hugging Face repositories and buckets via commands like
hf uploadandhf upload-large-folder.
Recommendations
- INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata