The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation describes the use of the trust_remote_code=True parameter. This is a legitimate feature of the Transformers library that allows users to run custom architecture code provided by models on the Hugging Face Hub. The skill provides a clear security warning that users should only enable this flag after reviewing the associated code.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading large machine learning models, datasets, and evaluation metrics from the Hugging Face Hub (huggingface.co). These downloads are core functionalities of the library and target a well-known, trusted service.
[CREDENTIALS_UNSAFE]: Guidance is provided for managing Hugging Face authentication tokens (HF_TOKEN). The instructions emphasize secure practices, such as using the hf auth login CLI or environment variables, and explicitly warn against hardcoding tokens in scripts, notebooks, or shared configurations.
[DATA_EXFILTRATION]: The skill mentions the default local cache location for authentication tokens (~/.cache/huggingface/token). Documenting this path is standard for users managing their authentication state and does not constitute a malicious data access attempt.

transformers