The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts in the scripts/ directory use subprocess.run to launch evaluation tools like inspect and lighteval. These commands are constructed using argument lists, which is a secure practice that prevents shell command injection.
[REMOTE_CODE_EXECUTION]: The wrapper scripts scripts/inspect_vllm_uv.py and scripts/lighteval_vllm_uv.py include an explicit security check that raises a ValueError if the --trust-remote-code flag is used. This prevents the agent from accidentally executing arbitrary code that may be present in external model repositories.
[CREDENTIALS_UNSAFE]: The skill manages Hugging Face authentication tokens (HF_TOKEN) by reading them from environment variables and propagating them to the relevant tools. This follows standard security practices for secret management. The provided .env.example file contains only a placeholder value.

huggingface-community-evals