hugging-face-model-trainer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly instructs embedding HF_TOKEN via constructs like secrets={"HF_TOKEN": "$HF_TOKEN"} and states "$HF_TOKEN" references your actual token value, which requires the agent to include the user's secret token in generated job submissions/commands (exposing secrets verbatim).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the workflow’s required dataset validation step can ingest previewed fields from an outsider-authored Hugging Face dataset via scripts/dataset_inspector.py calling the Datasets Server API (e.g., get_rows()), and then prints example text and “MAPPING CODE” to stdout for the agent to consume/act on.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches and executes remote scripts/repos at runtime (e.g., it runs the dataset inspector script at https://huggingface.co/datasets/mcp-tools/skills/raw/main/dataset_inspector.py and clones/uses llama.cpp via https://github.com/ggerganov/llama.cpp.git, and also runs TRL example scripts from raw.githubusercontent), which directly brings external code into the agent runtime.