huggingface-spaces

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides instructions for managing Hugging Face Spaces using the official hf CLI and trusted resources. All external references and downloads target the official Hugging Face domain or trusted organizations like Facebook Research.
  • [EXTERNAL_DOWNLOADS]: The skill references downloads for the huggingface_hub package and specific CUDA extension wheels hosted on Hugging Face's official domain (huggingface.co). These are trusted sources necessary for the machine learning development workflow described.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands for repository management, log monitoring, and hardware orchestration via the hf CLI. These operations are standard developer actions for the Hugging Face platform and do not involve arbitrary or malicious execution.
  • [DATA_EXFILTRATION]: The skill contains clear instructions for managing sensitive data, specifically recommending the use of --secrets for API keys and tokens. This ensures credentials are encrypted and hidden from Space visitors, conforming to platform security standards.
  • [REMOTE_CODE_EXECUTION]: The skill describes using SSH for debugging running Spaces (ssh.hf.space). The workflow requires the user to generate their own SSH keys and register them manually with their Hugging Face profile, which is a secure, platform-native method for remote access.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 08:30 PM
Security Audit — agent-trust-hub — huggingface-spaces