huggingface-gradio
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the
gr.HTMLcomponent which supportsjs_on_loadand JavaScript template expressions. This is a documented feature of the Gradio library used for creating interactive custom UI components. - [INDIRECT_PROMPT_INJECTION]: As a framework for building user interfaces, the patterns described involve ingesting data from untrusted sources via components such as
gr.Textbox,gr.File, andgr.ChatInterface. The documentation correctly notes that components likegr.Chatbotandgr.Markdownincludesanitize_html=Trueby default to mitigate XSS risks. - [COMMAND_EXECUTION]: The skill includes instructions for using the
gradioCLI utility. Theinfoandpredictcommands are used to discover and interact with remote API endpoints (Hugging Face Spaces), which involves standard network operations for the library.
Audit Metadata