huggingface-zerogpu
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing user-supplied prompts in Gradio interfaces. This creates a potential surface for indirect prompt injection, which is a common characteristic of ML demo skills. The documentation provides standard inference examples without specific guidance on input sanitization.
- Ingestion points: Gradio handler functions (e.g., generate(prompt)) in SKILL.md.
- Boundary markers: None present in the simplified code examples.
- Capability inventory: File system access via tempfile and GPU inference via transformers library.
- Sanitization: Not present in the provided examples.
- [EXTERNAL_DOWNLOADS]: The skill references several external resources, including official Hugging Face documentation and blog posts, as well as the Flash Attention project on GitHub. These are well-known, reputable sources in the machine learning ecosystem and are used here for legitimate technical reference.
- [REMOTE_CODE_EXECUTION]: The skill includes a shell utility command using curl to fetch PyPI metadata for package verification purposes. This is a common developer tool for dependency management and targets a whitelisted domain (pypi.org).
Audit Metadata