huggingface

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This is a mostly legitimate Hugging Face helper, but it gives an assistant broad token-backed power to upload or delete Hub content without enough guardrails.

Install only if you are comfortable letting the assistant operate Hugging Face with the permissions in HF_TOKEN. Prefer a fine-grained read-only or repo-scoped token, avoid full write tokens unless needed, review every upload/delete command before execution, and do not use --yes deletion in automation without an explicit approval step.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned and Overly Broad Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

" ``` 2. **Use hash-verified lock files** - Generate a lock or requirements file containing exact versions and cryptographic hashes for all transitive dependencies. - Install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 3. **Remove development dependencies from normal installation** - Do not recommend the `dev` extra to ordinary users. - Keep testing, linting, and packaging dependencies in a separate development-only lock file. 4. **Separate optional functionality** - Make `torch`, `tensorflow`, `fastai`, CLI support, and transfer acceleration separate opt-in installation profiles. - Document the minimum package set required for each operation. 5. **Review and automate dependency updates** - Review changelogs and provenance before updating pins. - Run vulnerability and license scanning against the complete locked dependency graph. - Update pins through controlled pull requests rather than resolving current releases during installation. 6. **Reduce runtime credential exposure** - Use fine-grained, repository-scoped Hugging Face tokens. - Avoid exposing write-capable tokens to dependency installation processes. - Perform dependency installation in an isolated build stage that does not contain `HF_TOKEN`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description significantly overstates the functionality. The code only provides read-oriented informational commands plus cache inspection and identity lookup. It does use HF_TOKEN from the environment consistently with the description, and it can search the Hub and inspect cache, but major declared capabilities—downloads, uploads, repo management, and Space deployment/management—are absent. This makes the declared purpose materially broader than the actual behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

| Variable | Default | Description |
|----------|---------|-------------|
| `HF_TOKEN` | — | Access token; required for private/gated/write operations |
| `HF_HOME` | `~/.cache/huggingface` | Root cache directory |
| `HF_HUB_CACHE` | `$HF_HOME/hub` | Model/dataset cache |
| `HF_DATASETS_CACHE` | `$HF_HOME/datasets` | Datasets library cache |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The huggingface-cli repo delete command and --yes flag are presented as standard usage, but the documentation does not explicitly warn that deleting a repository is a destructive action with potential permanent data loss. Because this behavior affects user data and system integrity, the markdown should clearly disclose the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The api.delete_repo(...) example deletes a repository, yet the surrounding text provides no warning that it is destructive. In markdown documentation, examples that remove remote resources should explicitly caution users about data loss and recommend verifying targets before execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes access to a sensitive environment variable (HF_TOKEN) and enables networked read/write operations against an external service, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the risk of unintended token use, unauthorized uploads/deletions, or broader-than-expected external interactions because the runtime cannot constrain the skill to least privilege.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

These lines instruct users to pass authentication tokens using --token TOKEN and export HF_TOKEN=hf_..., and note token storage locations. While informative, the document does not warn that CLI arguments and environment variables may be exposed through shell history, process listings, logs, or shared environments, which is a privacy and credential-safety concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This section includes upload functionality and a --delete PATTERN option that can remove remote files as part of a commit, but it does not explicitly warn users that these commands will change repository contents. For markdown documentation, potentially destructive or data-affecting behavior should be disclosed so users understand the impact before running commands.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/api_reference.md (reported line 150)May include surrounding context.

md

| `--type` | `model`, `dataset`, or `space` |
| `--private` | Create as private repo |
| `--exist-ok` | Don't error if repo already exists |
| `--yes` | Skip confirmation prompt on delete |

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The api.delete_file(...) example deletes a remote file, and later cache deletion is executed programmatically, but neither example includes a warning about removal of data. Since the markdown is a reference that users may copy directly, destructive examples should disclose that they delete files or cached revisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The examples show text prompts, an image file, and an audio file being submitted through InferenceClient, which transmits user content to an external API. The section does not warn users not to send sensitive, proprietary, or personal data unless appropriate for their environment and permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This example opens a Hub path in write mode and writes content remotely, which changes repository state. The documentation notes that a write token is required, but it does not clearly warn that this operation modifies remote data and should be used carefully.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file-level documentation presents this script as a general 'Hugging Face Hub helper' CLI, but the implemented commands only perform account lookup, metadata inspection, search, cache scanning, and listing Spaces/files. Given the skill manifest's broader claims of downloading assets, uploading files, managing repos and Spaces, and deployment automation, this code does not implement that claimed operational scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template includes multiple upload commands that send local files or folders to remote Hugging Face repositories, but it does not warn users about the risk of unintentionally disclosing secrets, proprietary data, personal data, or large unintended file sets. In a skill intended for Hub automation, this is materially risky because users may copy-paste commands like uploading entire folders or datasets without reviewing contents, include/exclude filters, or destination visibility settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template documents a non-interactive deletion command using '--yes' without a prominent warning that it irreversibly deletes a remote repository. In an automation-oriented skill, this increases the chance of accidental or scripted destructive actions against the wrong repo, especially when users adapt examples for CI or reuse shell history.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/api_reference.md (reported line 212)May include surrounding context.

md

# UPLOAD A SINGLE FILE
# ─────────────────────────────────────────────

# api.upload_file(
#     path_or_fileobj="weights.safetensors",
#     path_in_repo="weights.safetensors",
#     repo_id="myorg/mymodel",

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · templates/python_patterns.txt (reported line 63)May include surrounding context.

text

# UPLOAD A SINGLE FILE
# ─────────────────────────────────────────────

# api.upload_file(
#     path_or_fileobj="weights.safetensors",
#     path_in_repo="weights.safetensors",
#     repo_id="myorg/mymodel",

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The helper constructs the API client with HF_TOKEN from the environment, which is access to credentials/sensitive environment data. Although the module docstring mentions this behavior, the code path itself provides no runtime disclosure, confirmation, or logging when credentials are consumed.

Content

No source excerpt is available for this finding.