The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits metadata deception by claiming a 'source_type' of 'official' and pointing to the 'huggingface/skills' repository in its frontmatter, despite being authored by an external user ('sickn33'). This impersonation can lead users to trust the skill's high-privilege credential requests without appropriate vetting.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It instructs the agent to read and 'trust' parameters, dependencies, and code snippets from untrusted Hugging Face model cards (READMEs) to generate 'app.py' and 'requirements.txt' files.
Ingestion points: Reads 'README.md' and 'ModelCard' metadata from user-provided repository IDs via 'huggingface_hub.ModelCard.load'.
Boundary markers: None. The skill does not implement delimiters or instructions to ignore malicious directives within the fetched external content.
Capability inventory: The skill writes executable Python code ('app.py'), defines environment dependencies ('requirements.txt'), and executes the generated code locally using the 'gradio predict' command.
Sanitization: None. The skill explicitly directs the agent to 'trust' and 'lift' parameters and dependencies from the untrusted model cards.
[COMMAND_EXECUTION]: The skill performs smoke-testing in Phase 6 by running 'gradio predict' against newly generated application files. Because the application logic and dependencies are derived directly from untrusted external metadata, this represents the execution of potentially malicious code in the agent's environment.
[CREDENTIALS_UNSAFE]: The skill requests a Hugging Face access token with 'write' scope and stores it as a Space secret. While necessary for the skill's function, the high level of access increases the impact of potential exploitation through the identified injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill recommends using example media from third-party Hugging Face repositories (e.g., 'linoyts/repo-to-space-example-inputs'). While intended as media assets, these originate from unverified sources outside the official platform organization.

huggingface-lora-space-builder