Hugging Face CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.20.1

Overview

This Hugging Face CLI skill is mostly a command reference, but it asks agents to use broad authenticated Hub powers and pipe remote installers into a shell without enough scoping or safety guidance.

Review before installing. Use this skill only for explicit Hugging Face Hub tasks, avoid running commands that print tokens, prefer least-privilege tokens, confirm exact accounts and resource names before any upload/delete/deploy/job/webhook action, and do not pipe remote installer scripts directly into a shell unless you have independently verified the source and contents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:6

Finding

Unverified Hugging Face CLI Installer Is Executed Directly from the Network

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:6
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

markdown

Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`.

Technical Analysis

The installation command streams an HTTPS response directly into bash. The downloaded content is neither pinned to a specific immutable release nor verified with a cryptographic checksum or publisher signature before execution. The -L option also follows redirects, so the final source that supplies the executed script may differ from the displayed URL.

Although hf.co appears associated with Hugging Face, domain ownership alone does not establish the integrity of the script returned at execution time. The effective payload can change after this Skill has been reviewed. Compromise of the upstream installer, hosting account, redirect destination, release process, or relevant network trust infrastructure could consequently turn this instruction into arbitrary local code execution.

Direct shell execution is not the minimum privilege necessary for a documentation-only Skill. The Skill could instead refer users to a pinned package or provide a download-and-verification procedure.

Attack Path

1. An attacker compromises or maliciously modifies the remote installer, its hosting infrastructure, or a redirect destination.
2. A user or AI agent follows the installation instruction in SKILL.md.
3. curl retrieves the current network response and follows any server-directed redirects.
4. The response is passed directly to bash without being saved, reviewed, pinned, or cryptographically verified.
5. The attacker's commands execute with all permissions held by the invoking account.
6. The payload can access local files, credentials, environment variables, configuration, and network resources available to that account.

Impact Assessment

Success ...[truncated 387 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash installation instruction.
• Prefer installation through a trusted package manager with a pinned package version.
• If a script is necessary, pin it to an immutable release artifact rather than a mutable endpoint.
• Download the installer to a local file before execution and display or inspect its contents.
• Publish and verify a SHA-256 checksum and, preferably, a cryptographic publisher signature.
• Disable unexpected redirects or validate the final download origin.
• Require explicit user approval before executing the verified installer.
• Run installation with ordinary user privileges and avoid sudo unless a documented component strictly requires it.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:210

Finding

Mutable hf-mount Installer Is Downloaded from GitHub and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:210
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

markdown

Install: `curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh`

Technical Analysis

This instruction retrieves install.sh from the mutable main branch of the huggingface/hf-mount GitHub repository and pipes it directly into sh. The command does not pin an immutable commit, release, or content digest and performs no signature or checksum verification.

The repository belongs to the named Hugging Face organization rather than an evident personal account, but this does not eliminate supply-chain risk. Repository compromise, maintainer-account compromise, malicious changes, or compromised delivery infrastructure could alter the payload after the Skill audit. Because the response is executed immediately, no local review or integrity gate exists.

Installing hf-mount may be relevant to the optional filesystem-mount functionality, but unrestricted execution of mutable remote shell code exceeds the minimum permissions needed to explain or use that feature safely.

Attack Path

1. An attacker gains the ability to modify the main branch installer or the infrastructure serving the raw GitHub response.
2. Malicious shell commands are inserted into install.sh.
3. A user or agent executes the documented installation command.
4. curl downloads the attacker's current version of the script.
5. The response is streamed directly into sh, with no immutable version pin or integrity validation.
6. The payload executes with the invoking user's local permissions and can abuse any available credentials or filesystem access.

Impact Assessment

Exploitation results in arbitrary local command execution. The payload could read Hugging Face tokens such as HF_TOKEN, access repositories or buckets a ...[truncated 264 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pipe the GitHub response directly into a shell.
• Reference an immutable, reviewed commit or signed release instead of the mutable main branch.
• Download the installer separately and verify an independently published SHA-256 checksum or release signature.
• Allow the user to inspect the downloaded script before execution.
• Prefer a signed package distributed through a trusted package manager.
• Require explicit confirmation before installing optional mount functionality.
• Execute the installer with the least-privileged account and document every filesystem or system-level change it performs.
• Consider making hf-mount installation a separate, opt-in procedure rather than part of general CLI guidance.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:3

Finding

Overbroad Activation Instructions Can Route Unrelated Tasks to High-Privilege Hugging Face Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:3
Vulnerability Type: Skill instruction hijacking
Risk Level: Medium

Complete Code Snippet:

yaml

description: "Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`."

Technical Analysis

The description directs the agent to activate this Skill for anything related to AI, machine learning, cloud storage, data pipelines, or agent traces, even when the user has not requested a CLI operation. This scope substantially exceeds the declared purpose of providing Hugging Face CLI assistance.

The Skill exposes operations involving authentication tokens, local and remote data transfers, secrets, remote jobs, webhooks, repositories, endpoints, extensions, and destructive deletion commands. Forcing broad activation increases the chance that an unrelated request is handled through an authenticated, network-capable, and potentially destructive tool. The text does not itself prove that one of these operations will execute automatically, but i ...[truncated 1238 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict activation to explicit Hugging Face requests or tasks that clearly require the hf CLI.
• Remove instructions to activate the Skill for AI/ML topics in general, generic cloud storage, data pipelines, or agent traces.
• Do not activate the Skill merely because a request contains a broad ecosystem keyword when no Hugging Face action is needed.
• Require explicit user confirmation before authentication, uploads, secret handling, remote job execution, extension installation, mounts, webhook changes, resource creation, or destructive actions.
• Show the exact target account, namespace, repository, bucket, endpoint, local path, and remote destination before any consequential operation.
• Apply least-privilege Hugging Face tokens scoped only to the resources required for the current task.
• Default destructive commands to dry-run or preview modes where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to invoke the skill even without a direct CLI request blurs boundaries between informational assistance and tool-driven actions. In a skill that exposes account, repo, bucket, jobs, spaces, and endpoint management, unclear activation rules materially raise the risk of overreach or accidental operational changes.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The installation instruction pipes a remotely fetched script directly into 'bash', which executes unverified code from the network with no integrity check, pinning, or review step. This is a classic supply-chain risk: if the endpoint, transport, or upstream script is compromised, arbitrary code executes immediately on the host.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: "Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`."
---

Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`.

The Hugging Face Hub CLI tool `hf` is available. IMPORTANT: The `hf` command replaces the deprecated `huggingface-cli` command.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enumerates many destructive and irreversible commands—such as repo deletion, bucket deletion, volume removal, merge/close actions, endpoint deletion, and sync/delete behaviors—without prominent warnings or confirmation guidance. In practice, an agent using this skill could perform high-impact changes or data loss operations without the user understanding the risk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

### `hf auth` — Manage authentication (login, logout, etc.).

- `hf auth list` — List all stored access tokens. `[--format [auto|human|agent|json|quiet]]`
- `hf auth login` — Login from your browser, or using a token from huggingface.co/settings/tokens. `[--add-to-git-credential --force --format [auto|human|agent|json|quiet]]`
- `hf auth logout` — Logout from a specific token. `[--token-name TEXT --format [auto|human|agent|json|quiet]]`
- `hf auth switch` — Switch between access tokens. `[--token-name TEXT --add-to-git-credential --format [auto|human|agent|json|quiet]]`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The command 'hf auth token' explicitly prints the current access token to stdout, which can expose credentials to the agent transcript, terminal logs, telemetry, or downstream tooling. In a skill intended for assistant use, surfacing a raw token is especially dangerous because it may be unintentionally stored or echoed back to the user.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

- `hf auth list` — List all stored access tokens. `[--format [auto|human|agent|json|quiet]]`
- `hf auth login` — Login from your browser, or using a token from huggingface.co/settings/tokens. `[--add-to-git-credential --force --format [auto|human|agent|json|quiet]]`
- `hf auth logout` — Logout from a specific token. `[--token-name TEXT --format [auto|human|agent|json|quiet]]`
- `hf auth switch` — Switch between access tokens. `[--token-name TEXT --add-to-git-credential --format [auto|human|agent|json|quiet]]`
- `hf auth token` — Print the current access token to stdout. `[--format [auto|human|agent|json|quiet]]`
- `hf auth whoami` — Find out which huggingface.co account you are logged in as. `[--format [auto|human|agent|json|quiet]]`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The surrounding auth guidance continues to normalize commands that can reveal or manipulate credentials, including printing the current access token. In agentic contexts, this increases the likelihood of credential access or accidental leakage because the assistant may treat auth introspection as routine troubleshooting.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

- `hf auth login` — Login from your browser, or using a token from huggingface.co/settings/tokens. `[--add-to-git-credential --force --format [auto|human|agent|json|quiet]]`
- `hf auth logout` — Logout from a specific token. `[--token-name TEXT --format [auto|human|agent|json|quiet]]`
- `hf auth switch` — Switch between access tokens. `[--token-name TEXT --add-to-git-credential --format [auto|human|agent|json|quiet]]`
- `hf auth token` — Print the current access token to stdout. `[--format [auto|human|agent|json|quiet]]`
- `hf auth whoami` — Find out which huggingface.co account you are logged in as. `[--format [auto|human|agent|json|quiet]]`

### `hf buckets` — Commands to interact with buckets.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

- `hf spaces card SPACE_ID` — Get the Space card (README) for a Space on the Hub. `[--metadata --text --format [auto|human|agent|json|quiet]]`
- `hf spaces dev-mode SPACE_ID` — Enable or disable dev mode on a Space. `[--stop --format [auto|human|agent|json|quiet]]`
- `hf spaces hardware` — List available hardware options for Spaces. `[--format [auto|human|agent|json|quiet]]`
- `hf spaces hot-reload SPACE_ID` — Hot-reload any Python file of a Space without a full rebuild + restart. `[--local-file PATH --skip-checks --skip-summary --format [auto|human|agent|json|quiet]]`
- `hf spaces info SPACE_ID` — Get info about a space on the Hub. `[--revision TEXT --expand TEXT --format [auto|human|agent|json|quiet]]`
- `hf spaces list` — List spaces on the Hub, or files in a space repo. `[--search TEXT --author TEXT --filter TEXT --sort [created_at|last_modified|likes|trending_score] --limit INTEGER --expand TEXT --human-readable --tree --recursive --revision TEXT --format [auto|human|agent|json|quiet]]`
- `hf spaces logs SPACE_ID` — Fetch the run or build logs of a Space. `[--build --follow --tail INTEGER --format [auto|human|agent|json|quiet]]`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill recommends using the '--token' option or 'HF_TOKEN' without sufficiently emphasizing the leakage risk of command-line arguments, environment dumps, logs, and shell history. While recommending 'HF_TOKEN' is better than inline args, the absence of stronger secret-handling guidance still creates a meaningful credential exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md

- `--format` — Output format: `--format json` (or `--json`) or `--format table` (default).
- `-q / --quiet` — Quiet output (one ID per line).
- `--revision` — Git revision id which can be a branch name, a tag, or a commit hash.
- `--token` — Use a User Access Token. Prefer setting `HF_TOKEN` env var instead of passing `--token`.
- `--type` — The type of repository (model, dataset, or space).

## Mounting repos as local filesystems

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction to invoke the skill even without a direct CLI request blurs boundaries between informational assistance and tool-driven actions. In a skill that exposes account, repo, bucket, jobs, spaces, and endpoint management, unclear activation rules materially raise the risk of overreach or accidental operational changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes authentication, secret, token, env-file, and webhook secret handling, but does not provide clear privacy guidance about avoiding token exposure in stdout, logs, shell history, prompts, or command arguments. Commands like 'hf auth token' and options like '--token', '--secrets', and '--env-file' create a realistic risk of credential disclosure if used naively.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The hf-mount installation instruction also uses a remote script piped directly to 'sh', creating the same supply-chain execution risk as the primary installer. Although presented as an optional helper tool, it still grants immediate code execution from an external source without verification.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md

To mount Hub repositories or buckets as local filesystems — no download, no copy, no waiting — use `hf-mount`. Files are fetched on demand. GitHub: https://github.com/huggingface/hf-mount

Install: `curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh`

Some command examples:
- `hf-mount start repo openai-community/gpt2 /tmp/gpt2` — mount a repo (read-only)

Static analysis

No suspicious patterns detected.