hf-cli
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides shell commands to install the
hfCLI andhf-mounttool usingcurlpiped tobashorsh. These installation scripts are hosted onhf.coandraw.githubusercontent.com/huggingface/, which are well-known official domains for the Hugging Face platform. - [REMOTE_CODE_EXECUTION]: Several commands facilitate the execution of remote logic, such as
hf extensions installfor installing GitHub-hosted extensions andhf jobs uv runfor running scripts on Hugging Face infrastructure. These represent core functionalities of the Hugging Face Hub CLI for AI development workflows. - [COMMAND_EXECUTION]: The skill defines a large surface of command-line operations for managing the Hugging Face environment, including repository management, bucket operations, and local cache pruning.
- [CREDENTIALS_UNSAFE]: The instructions describe the use of authentication commands (
hf auth login,hf auth list) and environment variables (HF_TOKEN) for secret management. These are standard security practices for CLI-based authentication and do not involve hardcoded secrets.
Recommendations
- INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh
Audit Metadata