The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes several network requests using curl to huggingface.co official API endpoints. These are well-known, trusted services used for their intended purpose of fetching model and benchmark metadata.
[COMMAND_EXECUTION]: Uses curl and jq to process data from the Hugging Face API. These commands are static, do not incorporate unsanitized user input into the shell, and are used for data retrieval only.
[CREDENTIALS_UNSAFE]: The skill correctly references the user's local Hugging Face token at ~/.cache/huggingface/token rather than hardcoding any secrets. This is a standard and safe practice for authenticating with the Hugging Face API.
[DATA_EXFILTRATION]: While the skill reads the local Hugging Face token, it only sends it to the official huggingface.co API to fetch public model information. There is no evidence of data being sent to unauthorized third-party domains.
[PROMPT_INJECTION]: The instructions are clear and instructional without any attempts to bypass safety filters, override system prompts, or extract sensitive internal instructions.

huggingface-best