hf-cli

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides shell commands to install the hf CLI and hf-mount tool using curl piped to bash or sh. These installation scripts are hosted on hf.co and raw.githubusercontent.com/huggingface/, which are well-known official domains for the Hugging Face platform.
  • [REMOTE_CODE_EXECUTION]: Several commands facilitate the execution of remote logic, such as hf extensions install for installing GitHub-hosted extensions and hf jobs uv run for running scripts on Hugging Face infrastructure. These represent core functionalities of the Hugging Face Hub CLI for AI development workflows.
  • [COMMAND_EXECUTION]: The skill defines a large surface of command-line operations for managing the Hugging Face environment, including repository management, bucket operations, and local cache pruning.
  • [CREDENTIALS_UNSAFE]: The instructions describe the use of authentication commands (hf auth login, hf auth list) and environment variables (HF_TOKEN) for secret management. These are standard security practices for CLI-based authentication and do not involve hardcoded secrets.
Recommendations
  • INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 01:27 PM
Security Audit — agent-trust-hub — hf-cli