huggingface-lora-space-builder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to ask the user to paste a Hugging Face access token into chat and to use that token for HfApi calls and publishing (and to add it as a Space secret), which requires the LLM to accept and handle a secret value and risks it being echoed or embedded in outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill reads outsider-authored free text from the user-provided LoRA repo at runtime—specifically the model card README body (ModelCard.load(...).text) and example prompts/media—then injects that text into the agent’s LLM context to decide pipeline/UI/hyperparameters (indirect prompt injection risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly recommends fetching and installing remote code at build/runtime (e.g. adding git+https://github.com/huggingface/diffusers or git+https://github.com/Lightricks/LTX-Video.git in requirements.txt) and injecting CDN-hosted JS into the page (e.g. https://cdnjs.cloudflare.com/.../three.min.js or jsdelivr/unpkg URLs via demo.launch(head=...)), which will fetch and execute external code during Space build or in-browser runtime and are described as required dependencies for certain pipelines/UIs.