hugging-face-jobs

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements proactive security measures to protect the execution environment.
  • The script finepdfs-stats.py includes a safe_user_path function that validates and resolves user-provided paths to prevent path traversal attacks.
  • Documentation in SKILL.md and references/token_usage.md provides clear, high-security guidance on using the platform's secrets mechanism for the HF_TOKEN rather than hardcoding credentials or using less secure environment variables.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the execution of remote scripts and the processing of datasets hosted on the Hugging Face Hub.
  • Remote code patterns are directed toward huggingface.co, which is a well-known and trusted service for machine learning workloads.
  • Dependencies listed in the PEP 723 headers of the scripts are standard, versioned libraries from official registries (PyPI), such as transformers, torch, polars, and vllm.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 05:18 PM