hugging-face-paper-publisher

SUSPICIOUS: The stated purpose, requested HF write token, and Hugging Face/arXiv workflow are broadly coherent, and the dependency path appears to use normal Python tooling. However, the core script that would receive the token and perform network writes is missing from the provided content, so credential handling and endpoint integrity cannot be verified. Risk is medium due to incomplete visibility plus unpinned runtime dependency installation, not because of clear malicious behavior.