hugging-face-cli
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches and executes setup scripts from official Hugging Face infrastructure. The documentation includes commands for installing the
hfCLI tool (https://hf.co/cli/install.sh) and thehf-mountutility (https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh). Both commands follow a pattern of downloading the script to a temporary directory, offering the user a chance to review it vialess, and then performing execution viabashorsh.- [COMMAND_EXECUTION]: Defines extensive CLI capabilities for interacting with the Hugging Face platform. This includeshf jobs runandhf jobs scheduled uv runfor executing code on remote infrastructure, andhf extensions installfor adding tool functionality from GitHub repositories.- [DATA_EXFILTRATION]: Documents commands for managing platform authentication, includinghf auth loginfor credential storage andhf auth tokenfor retrieving the current access token. These are standard administrative functions for the described service and do not represent unauthorized exfiltration.
Recommendations
- INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata