huggingface-spaces
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for managing Hugging Face Spaces using the official
hfCLI and trusted resources. All external references and downloads target the official Hugging Face domain or trusted organizations like Facebook Research. - [EXTERNAL_DOWNLOADS]: The skill references downloads for the
huggingface_hubpackage and specific CUDA extension wheels hosted on Hugging Face's official domain (huggingface.co). These are trusted sources necessary for the machine learning development workflow described. - [COMMAND_EXECUTION]: The skill utilizes shell commands for repository management, log monitoring, and hardware orchestration via the
hfCLI. These operations are standard developer actions for the Hugging Face platform and do not involve arbitrary or malicious execution. - [DATA_EXFILTRATION]: The skill contains clear instructions for managing sensitive data, specifically recommending the use of
--secretsfor API keys and tokens. This ensures credentials are encrypted and hidden from Space visitors, conforming to platform security standards. - [REMOTE_CODE_EXECUTION]: The skill describes using SSH for debugging running Spaces (
ssh.hf.space). The workflow requires the user to generate their own SSH keys and register them manually with their Hugging Face profile, which is a secure, platform-native method for remote access.
Audit Metadata