hugging-face-model-trainer
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The model conversion script (
scripts/convert_to_gguf.py) clones the officialllama.cpprepository from GitHub and executes its conversion and quantization tools. It also installs required Python dependencies viapip. These actions are standard for the skill's purpose of optimizing models for local deployment. - [COMMAND_EXECUTION]: The conversion script utilizes the
subprocessmodule to manage build processes (CMake/Make) and run quantization binaries. The implementation uses non-shell execution (shell=False) and incorporates input validation logic to mitigate command injection risks when handling repository identifiers. - [EXTERNAL_DOWNLOADS]: The skill fetches official training scripts from the Hugging Face TRL repository and dataset inspection utilities from the Hugging Face Hub. These downloads target well-known services and repositories maintained by established organizations in the AI ecosystem.
Audit Metadata