The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches installation scripts for the hf CLI and hf-mount utility from the Hugging Face official domain and public GitHub repository.
[REMOTE_CODE_EXECUTION]:
The hf extensions install command allows the installation and subsequent execution of extensions from public GitHub repositories.
The hf jobs uv run and hf jobs scheduled uv run commands facilitate the execution of Python scripts, which can be sourced from local paths or remote URLs, on Hugging Face's remote infrastructure.
[COMMAND_EXECUTION]: Provides an extensive set of commands for interacting with the Hugging Face ecosystem, including managing authentication states, repository settings, and running infrastructure jobs.
[DATA_EXFILTRATION]: Includes functional commands for copying, syncing, and uploading local files, folders, and data structures to the Hugging Face Hub and associated cloud buckets.
[PROMPT_INJECTION]:
Ingestion points: The skill can read potentially untrusted content from the Hub, including model/dataset cards (READMEs), academic papers via the hf papers read command, and repository discussions or pull requests.
Boundary markers: There are no explicit instructions or delimiters defined to separate processed external content from agent instructions.
Capability inventory: The skill possesses high-privilege capabilities including network operations, file system access, and the ability to execute remote scripts and extensions.
Sanitization: The skill does not specify sanitization or validation logic for markdown, SQL queries, or discussion content fetched from external sources.

hf-cli