huggingface-lora-space-builder
Fail
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions provide for the modification of user inputs by automatically prepending trigger words without user oversight. Additionally, the metadata contains deceptive information, claiming 'official' status and source affiliation with 'huggingface' while the skill is authored by a third party ('sickn33'). Hidden UI components (visible=False Textbox) are used to manage data flow between execution environments.
- [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to request a Hugging Face access token with write scope from the user. This token grants high-level permissions to modify repositories, manage account secrets, and access private data.
- [REMOTE_CODE_EXECUTION]: The skill generates and uploads Python code to a remote environment (Hugging Face Spaces) and facilitates the installation of dependencies from arbitrary GitHub repositories (e.g., Lightricks/LTX-Video, Lightricks/LTX-2).
- [DATA_EXFILTRATION]: The combination of high-privilege write tokens and the automated reading of private repository content creates a risk where sensitive data or credentials can be exfiltrated to the newly created Space or an attacker-controlled repository.
- [COMMAND_EXECUTION]: The skill automates the creation, configuration, and deployment of executable files (app.py, requirements.txt) to cloud infrastructure.
- [EXTERNAL_DOWNLOADS]: The skill identifies and installs dependencies from external repositories and model cards, which serves as an ingestion point for untrusted code instructions.
- [PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface by processing untrusted data from LoRA repositories (README files and model cards) to influence the generation of executable code.
- Ingestion points: Reads repository file lists and model card metadata from user-specified repositories via HfApi.
- Boundary markers: None implemented to delimit or ignore instructions embedded in repository content.
- Capability inventory: Ability to create repositories, upload files, and set account-level secrets (HF tokens).
- Sanitization: Relies on external data to determine pipeline classes and parameters without validation.
Recommendations
- AI detected serious security threats
Audit Metadata