The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Hugging Face packages (@huggingface/transformers, @huggingface/tokenizers) via npm and loading library assets from the JSDelivr CDN. These are established, well-known services.
[EXTERNAL_DOWNLOADS]: The skill's primary function involves downloading machine learning models (ONNX format) from the Hugging Face Hub (huggingface.co). These downloads are fundamental to the stated purpose of the skill and target a trusted organization.
[DATA_EXFILTRATION]: Documentation in references/CONFIGURATION.md and references/CACHE.md provides templates for managing authentication (e.g., HF_TOKEN) and custom caching (e.g., S3). These are documented as configuration options for the developer and do not contain hardcoded secrets or malicious exfiltration logic.
[COMMAND_EXECUTION]: The skill includes standard terminal commands for package installation and CLI usage examples. All commands are consistent with the development workflows of the Transformers.js library.
[PROMPT_INJECTION]: As a machine learning tool, the skill processes external input data (text, images, audio). While this represents a surface for indirect prompt injection, it is the intended functionality of the integration, and the documentation includes configuration options to mitigate risks (such as local_files_only mode).

transformers-js