The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches dataset lists, leaderboards, and model metadata from HuggingFace's official API endpoints (huggingface.co). These interactions are directed at a well-known service and are necessary for the skill's primary function of providing up-to-date model recommendations.- [COMMAND_EXECUTION]: The skill uses shell commands, including curl, export, and jq, to perform network requests and process JSON data. It also utilizes the hf-cli for retrieving model information. There is a potential attack surface where identifiers extracted from user input or external API responses are interpolated into shell commands; however, the risk is mitigated by the agent's role in selecting these identifiers from structured API results.- [DATA_EXFILTRATION]: The skill accesses the local HuggingFace authentication token stored at ~/.cache/huggingface/token. This token is exported to an environment variable (HF_AUTH) and used exclusively to authenticate requests sent to the official HuggingFace API, which is the legitimate destination for these credentials.- [PROMPT_INJECTION]: The skill ingests data from external HuggingFace model cards and leaderboards, which could contain adversarial instructions.
Ingestion points: External data enters the agent context via API responses from huggingface.co (SKILL.md).
Boundary markers: None are explicitly defined to separate external model metadata from the agent's core instructions.
Capability inventory: The skill has access to shell execution (bash), network tools (curl), and the HuggingFace CLI (hf-cli).
Sanitization: The skill uses jq to extract specific fields, providing a layer of structural validation for the ingested JSON data.

huggingface-best