huggingface-hub
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command
curl -LsSf https://hf.co/cli/install.sh | bash -swhich fetches and executes a script from Hugging Face's official domain. - [INDIRECT_PROMPT_INJECTION]: The skill documents capabilities that ingest external data, such as executing SQL queries against datasets (
hf datasets sql) and running Python scripts with dependencies (hf jobs uv). - Ingestion points: Dataset SQL queries and Python job scripts.
- Boundary markers: None specified in the reference guide.
- Capability inventory: Utilizes the
hfCLI for data processing and remote compute tasks. - Sanitization: No explicit sanitization or validation logic is defined in the documentation provided.
Audit Metadata