hugging-face-jobs
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements proactive security measures to protect the execution environment.
- The script
finepdfs-stats.pyincludes asafe_user_pathfunction that validates and resolves user-provided paths to prevent path traversal attacks. - Documentation in
SKILL.mdandreferences/token_usage.mdprovides clear, high-security guidance on using the platform's secrets mechanism for theHF_TOKENrather than hardcoding credentials or using less secure environment variables. - [EXTERNAL_DOWNLOADS]: The skill facilitates the execution of remote scripts and the processing of datasets hosted on the Hugging Face Hub.
- Remote code patterns are directed toward
huggingface.co, which is a well-known and trusted service for machine learning workloads. - Dependencies listed in the PEP 723 headers of the scripts are standard, versioned libraries from official registries (PyPI), such as
transformers,torch,polars, andvllm.
Audit Metadata