huggingface-lora-space-builder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to ask the user to "Paste" a Hugging Face access token into the chat and then reuse that token for repo creation and setting Space secrets, meaning the LLM would receive and be expected to handle a secret value in plaintext (exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Phase 1/2, the agent fetches and reads the outsider-authored LoRA repository contents at runtime—ModelCard.load(repo_id) and list_repo_files(repo_id) consume the README/model-card text (including example prompts/code) before selecting the pipeline and constructing the UI.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill recommends pulling and installing code at build/runtime from git+https://github.com/huggingface/diffusers and git+https://github.com/Lightricks/LTX-Video.git (used in requirements/native-path examples) and injecting a CDN script https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js into Gradio head — all of which are fetched at runtime and execute remote code, so they are runtime external dependencies the Space may rely on.