HF Spaces

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:10 PM UTC
• Version: 1.0.2

Overview

This skill is a straightforward Hugging Face generation helper, with normal third-party service and dependency-install risks that users should understand before use.

Install this only if you are comfortable sending prompts, input media, and generated outputs to Hugging Face Spaces or providers. Prefer running setup in a contained project, pin dependencies if reproducibility matters, and avoid using sensitive prompts or credentials unless the selected Space or provider is trusted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 25–29 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### Setup ```bash uv init && uv add gradio_client huggingface_hub ``` ``` ### Technical Analysis The setup instructions install `gradio_client`, `huggingface_hub`, and their transitive dependencies without version constraints, integrity hashes, or a committed and reviewed lockfile. Consequently, dependency resolution may select package versions that differ from those originally reviewed. This creates a supply-chain risk because a future compromised, malicious, or unexpectedly incompatible package release could be installed when the documented command is executed. Package-controlled code may then run during installation or when the packages are imported and used by the generated scripts. The audit found no evidence that the named packages are currently malicious. The vulnerability is the absence of reproducible and integrity-controlled dependency resolution. ### Attack Path 1. An attacker compromises a direct or transitive dependency release, or otherwise causes an unsafe version to become available through the configured package source. 2. A user or agent follows the Skill's setup instructions and runs: ```bash uv init && uv add gradio_client huggingface_hub ``` 3. `uv` resolves the current mutable versions of the packages and their transitive dependencies. 4. The compromised dependency is downloaded and installed without comparison against reviewed versions or expected hashes. 5. Malicious package code executes during installation or subsequent import and runs with the permissions of the invoking process. ### Impact Assessment Successful exploitation could permit code execution with the privileges of the user running the setup or generation script. Depending on that user's environment and permissions, the compromised package could access: - Files re ...[truncated 453 chars]
• Remediation: ## Remediation Suggestions 1. Pin `gradio_client` and `huggingface_hub` to exact, reviewed versions rather than resolving unrestricted latest releases. 2. Generate and commit a `uv.lock` file that includes the complete transitive dependency graph. 3. Require locked, reproducible installation, such as: ```bash uv sync --locked ``` 4. Configure installation to fail when the lockfile is absent or inconsistent instead of silently resolving new versions. 5. Where supported by the deployment workflow, verify package hashes and use a trusted or internally controlled package index. 6. Review dependency updates before changing pinned versions or regenerating the lockfile. 7. Run dependency installation and generated scripts in a sandbox or container with: - No unnecessary credentials - Minimal filesystem access - Restricted network access - Non-administrative privileges 8. Add automated dependency vulnerability and provenance scanning to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger text is very broad and matches common creative requests like image generation, video generation, and generic requests to 'use this Space.' This can cause the skill to activate in situations where the user did not explicitly intend to route content to HuggingFace services, increasing the chance of unintended third-party data disclosure or unreviewed external tool use.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The examples send prompts to remote HuggingFace Spaces/Inference Providers and save returned content to local files, but they do not warn that user input will leave the local environment or that artifacts will be written to disk. In this skill context, the omission is meaningful because the core functionality depends on third-party network calls and file creation, so users may unknowingly expose sensitive prompts or create local outputs with privacy, storage, or compliance implications.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The text-to-speech example sets `language="English"` directly, which can impose a specific language in a way that is not presented as optional or user-selected. There is no accompanying instruction to ask the user for their preferred language or to justify an English-only constraint.