hugging-face-model-trainer
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/convert_to_gguf.pyscript utilizessubprocess.runto discover system tools (git, cmake), install dependencies via pip, clone the llama.cpp repository, and build the quantization binary. These operations are necessary for the model conversion process and are performed within the scope of the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from trusted organizations, including official TRL scripts from the Hugging Face GitHub repository and dataset previews from the Hugging Face Datasets Server API. These sources are well-known and recognized as safe.
- [SAFE]: Authentication is handled correctly using platform secrets (
HF_TOKEN), and no patterns of prompt injection, data exfiltration, or code obfuscation were detected during the analysis.
Audit Metadata