huggingface-best
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the Hugging Face authentication token stored at
~/.cache/huggingface/tokento authenticate API requests. This is standard behavior for Hugging Face integration and the token is sent only to officialhuggingface.coAPI endpoints. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to
huggingface.coto fetch benchmark data, leaderboard rankings, and model metadata. These are directed at a well-known, trusted service for the skill's primary purpose of model comparison. - [COMMAND_EXECUTION]: The skill uses
curl,jq, and thehfCLI to interact with the Hugging Face Hub. These commands are used for data retrieval and metadata parsing and do not involve arbitrary command injection or unauthorized system changes.
Audit Metadata