huggingface

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This is a mostly legitimate Hugging Face helper, but it gives an assistant broad token-backed power to upload or delete Hub content without enough guardrails.

Install only if you are comfortable letting the assistant operate Hugging Face with the permissions in HF_TOKEN. Prefer a fine-grained read-only or repo-scoped token, avoid full write tokens unless needed, review every upload/delete command before execution, and do not use --yes deletion in automation without an explicit approval step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44
• Finding: Unpinned and Overly Broad Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44-60 **Vulnerability Type**: Unpinned third-party packages and unnecessary development dependencies **Risk Level**: Medium ### Vulnerable Code ```bash ### Minimum install ```bash pip install huggingface_hub ``` ### Recommended install with all extras ```bash pip install "huggingface_hub[cli,torch,tensorflow,fastai,dev]" ``` | Extra | Adds | |-------|------| | `cli` | `huggingface-cli` command | | `hf_transfer` | Fast Rust-based multi-part downloads (`pip install hf_transfer`) | | `torch` | PyTorch model helpers | | `tensorflow` | TensorFlow model helpers | | `fastai` | fastai helpers | ``` The project metadata also declares the dependency without a version constraint: ```yaml install: - kind: pip package: huggingface_hub bins: [huggingface-cli] ``` ### Technical Analysis The installation instructions resolve `huggingface_hub`, `hf_transfer`, and all transitive dependencies from the package index without pinning reviewed versions or verifying package hashes. As a result, the code installed by users can change after the Skill itself has been audited. The recommended command additionally installs the `dev` extra and several large machine-learning framework extras. Development dependencies are not required for normal Hub operations and substantially increase the number of packages, build scripts, native components, and transitive dependencies that must be trusted. Python packages and their build backends may execute code during installation. A compromised upstream release, compromised maintainer account, malicious transitive dependency, or unexpected dependency-resolution change could therefore introduce attacker-controlled code despite no corresponding change to this repository. This finding does not establish that the currently published packages are malicious. The security weakness is the mutable and unnecessarily broad supply-chain trust boundary created by the install ...[truncated 1719 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Pin reviewed dependency versions** - Replace unconstrained package declarations with exact, reviewed versions. - Apply the same constraint in both Skill metadata and installation documentation. - Example: ```bash pip install "huggingface_hub==<reviewed-version>" ``` 2. **Use hash-verified lock files** - Generate a lock or requirements file containing exact versions and cryptographic hashes for all transitive dependencies. - Install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 3. **Remove development dependencies from normal installation** - Do not recommend the `dev` extra to ordinary users. - Keep testing, linting, and packaging dependencies in a separate development-only lock file. 4. **Separate optional functionality** - Make `torch`, `tensorflow`, `fastai`, CLI support, and transfer acceleration separate opt-in installation profiles. - Document the minimum package set required for each operation. 5. **Review and automate dependency updates** - Review changelogs and provenance before updating pins. - Run vulnerability and license scanning against the complete locked dependency graph. - Update pins through controlled pull requests rather than resolving current releases during installation. 6. **Reduce runtime credential exposure** - Use fine-grained, repository-scoped Hugging Face tokens. - Avoid exposing write-capable tokens to dependency installation processes. - Perform dependency installation in an isolated build stage that does not contain `HF_TOKEN`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description significantly overstates the functionality. The code only provides read-oriented informational commands plus cache inspection and identity lookup. It does use HF_TOKEN from the environment consistently with the description, and it can search the Hub and inspect cache, but major declared capabilities—downloads, uploads, repo management, and Space deployment/management—are absent. This makes the declared purpose materially broader than the actual behavior.

Credential Access

High

• Category: Privilege Escalation

Content

| Variable | Default | Description |
|----------|---------|-------------|
| `HF_TOKEN` | — | Access token; required for private/gated/write operations |
| `HF_HOME` | `~/.cache/huggingface` | Root cache directory |
| `HF_HUB_CACHE` | `$HF_HOME/hub` | Model/dataset cache |
| `HF_DATASETS_CACHE` | `$HF_HOME/datasets` | Datasets library cache |

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The `huggingface-cli repo delete` command and `--yes` flag are presented as standard usage, but the documentation does not explicitly warn that deleting a repository is a destructive action with potential permanent data loss. Because this behavior affects user data and system integrity, the markdown should clearly disclose the risk.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The `api.delete_repo(...)` example deletes a repository, yet the surrounding text provides no warning that it is destructive. In markdown documentation, examples that remove remote resources should explicitly caution users about data loss and recommend verifying targets before execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes access to a sensitive environment variable (`HF_TOKEN`) and enables networked read/write operations against an external service, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk of unintended token use, unauthorized uploads/deletions, or broader-than-expected external interactions because the runtime cannot constrain the skill to least privilege.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: These lines instruct users to pass authentication tokens using `--token TOKEN` and `export HF_TOKEN=hf_...`, and note token storage locations. While informative, the document does not warn that CLI arguments and environment variables may be exposed through shell history, process listings, logs, or shared environments, which is a privacy and credential-safety concern.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This section includes `upload` functionality and a `--delete PATTERN` option that can remove remote files as part of a commit, but it does not explicitly warn users that these commands will change repository contents. For markdown documentation, potentially destructive or data-affecting behavior should be disclosed so users understand the impact before running commands.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `--type` | `model`, `dataset`, or `space` |
| `--private` | Create as private repo |
| `--exist-ok` | Don't error if repo already exists |
| `--yes` | Skip confirmation prompt on delete |

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The `api.delete_file(...)` example deletes a remote file, and later cache deletion is executed programmatically, but neither example includes a warning about removal of data. Since the markdown is a reference that users may copy directly, destructive examples should disclose that they delete files or cached revisions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples show text prompts, an image file, and an audio file being submitted through `InferenceClient`, which transmits user content to an external API. The section does not warn users not to send sensitive, proprietary, or personal data unless appropriate for their environment and permissions.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: This example opens a Hub path in write mode and writes content remotely, which changes repository state. The documentation notes that a write token is required, but it does not clearly warn that this operation modifies remote data and should be used carefully.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The file-level documentation presents this script as a general 'Hugging Face Hub helper' CLI, but the implemented commands only perform account lookup, metadata inspection, search, cache scanning, and listing Spaces/files. Given the skill manifest's broader claims of downloading assets, uploading files, managing repos and Spaces, and deployment automation, this code does not implement that claimed operational scope.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template includes multiple upload commands that send local files or folders to remote Hugging Face repositories, but it does not warn users about the risk of unintentionally disclosing secrets, proprietary data, personal data, or large unintended file sets. In a skill intended for Hub automation, this is materially risky because users may copy-paste commands like uploading entire folders or datasets without reviewing contents, include/exclude filters, or destination visibility settings.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The template documents a non-interactive deletion command using '--yes' without a prominent warning that it irreversibly deletes a remote repository. In an automation-oriented skill, this increases the chance of accidental or scripted destructive actions against the wrong repo, especially when users adapt examples for CI or reuse shell history.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

# UPLOAD A SINGLE FILE
# ─────────────────────────────────────────────

# api.upload_file(
#     path_or_fileobj="weights.safetensors",
#     path_in_repo="weights.safetensors",
#     repo_id="myorg/mymodel",

• Confidence: 55% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

# UPLOAD A SINGLE FILE
# ─────────────────────────────────────────────

# api.upload_file(
#     path_or_fileobj="weights.safetensors",
#     path_in_repo="weights.safetensors",
#     repo_id="myorg/mymodel",

• Confidence: 55% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The helper constructs the API client with HF_TOKEN from the environment, which is access to credentials/sensitive environment data. Although the module docstring mentions this behavior, the code path itself provides no runtime disclosure, confirmation, or logging when credentials are consumed.

Static analysis

No suspicious patterns detected.