huggingface-tool-builder
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to official Hugging Face domains (huggingface.co) to retrieve model metadata, dataset information, and README files. These operations are essential to the skill's functionality and target a well-known, trusted service.
- [COMMAND_EXECUTION]: Several provided scripts (Shell, Python, and TypeScript) execute commands to process data and interact with the Hugging Face CLI ('hf'). These scripts are transparent, use standard libraries, and employ safe practices such as temporary directory management for file processing.
- [SAFE]: The skill correctly handles sensitive information by instructing users to use the 'HF_TOKEN' environment variable for authentication rather than hardcoding credentials. This approach minimizes the risk of accidental credential exposure while enabling authenticated access to the API.
- [SAFE]: Data processing techniques, including the use of Base64 encoding for JSON serialization in shell scripts, are used legitimately for robust data handling and do not constitute malicious obfuscation.
Audit Metadata