The Agent Skills Directory

[METADATA_POISONING]: The skill's metadata contains deceptive information regarding its origin. The frontmatter claims the source repository is huggingface/skills and the source type is official, which contradicts the actual author identity. This misrepresentation could lead users to misjudge the safety and authority of the skill's instructions.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API and uses it to construct shell commands, creating a potential command injection surface.
Ingestion points: The skill retrieves file lists and names from the Hugging Face Tree API (https://huggingface.co/api/models/<repo>/tree/main?recursive=true) as described in references/hub-discovery.md.
Boundary markers: Absent. There are no instructions or delimiters to ensure the agent ignores or sanitizes malicious content within the fetched filenames.
Capability inventory: The skill instructs the execution of shell commands using llama-cli, llama-server, and llama-quantize across several files.
Sanitization: Absent. The instructions direct the agent to use the path field from the API response directly in command arguments (e.g., --hf-file <filename.gguf>) without validation or escaping logic.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands for software installation (brew, winget), repository cloning, and running local servers. While these are appropriate for the skill's stated purpose, they represent a significant capability tier that could be exploited via the indirect injection surface noted above.
[EXTERNAL_DOWNLOADS]: The skill downloads software and configuration from external sources.
Fetches the llama.cpp source code from its official repository on GitHub.
Downloads model checkpoints and configuration files from Hugging Face.

huggingface-local-models