The Agent Skills Directory

[SAFE]: The skill is designed to interact exclusively with Hugging Face (huggingface.co), which is a well-known and established service for machine learning assets.
[COMMAND_EXECUTION]: The provided reference scripts (e.g., references/baseline_hf_api.sh, references/hf_enrich_models.sh) execute standard commands such as curl, jq, and the official hf CLI. These are used for querying model metadata and downloading repository files as intended for the skill's purpose.
[CREDENTIALS_UNSAFE]: The skill follows secure credential management practices by instructing the agent and user to use the HF_TOKEN environment variable for authentication, avoiding hardcoded secrets within the scripts.
[DYNAMIC_EXECUTION]: The script references/hf_model_card_frontmatter.sh uses inline Python blocks to parse YAML frontmatter from model README files. This is a local data transformation step used to structure information downloaded from the repository.
[PROMPT_INJECTION]: The skill includes a potential surface for indirect prompt injection as it processes user-generated content (README.md files) from external Hugging Face repositories. The scripts mitigate this by using structured parsing (via jq and specific Python logic) rather than direct text interpolation into instructions.

huggingface-tool-builder