Hugging Face CLI

• Outcome: Review
• Latest audit: Jun 23, 2026 · 3:41 PM UTC
• Version: 1.20.1

Overview

This skill is a legitimate-looking Hugging Face CLI reference, but it gives an agent broad authority over accounts, tokens, remote resources, and installs without enough scoping or safety guidance.

Review this before installing if you let agents act autonomously. Use it only for explicit Hugging Face tasks, avoid commands that print tokens, require confirmation for deletes/uploads/deployments/jobs/webhooks/skill installs, prefer dry-run modes where available, and consider installing the CLI through a pinned or verifiable package method instead of piping remote scripts into a shell.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The activation guidance is materially overbroad: it instructs the assistant to invoke this skill for general AI/ML topics and even generic cloud-storage use, far beyond narrow Hugging Face CLI tasks. That can cause inappropriate tool selection and accidental execution of powerful commands with remote side effects, especially since this CLI supports uploads, deletions, jobs, secrets, and endpoint management.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill advertises many destructive and sensitive capabilities—token management, uploads, repo deletion, bucket deletion, job execution, endpoint deployment, webhook configuration—without prominent safety guidance about confirmation, credential sensitivity, billing, or irreversible actions. In an agent setting, omission of these guardrails increases the chance of harmful autonomous actions or unsafe handling of secrets.

Credential Access

High

• Category: Privilege Escalation

Content

- `hf auth list` — List all stored access tokens. `[--format [auto|human|agent|json|quiet]]`
- `hf auth login` — Login from your browser, or using a token from huggingface.co/settings/tokens. `[--add-to-git-credential --force --format [auto|human|agent|json|quiet]]`
- `hf auth logout` — Logout from a specific token. `[--token-name TEXT --format [auto|human|agent|json|quiet]]`
- `hf auth switch` — Switch between access tokens. `[--token-name TEXT --add-to-git-credential --format [auto|human|agent|json|quiet]]`
- `hf auth token` — Print the current access token to stdout. `[--format [auto|human|agent|json|quiet]]`
- `hf auth whoami` — Find out which huggingface.co account you are logged in as. `[--format [auto|human|agent|json|quiet]]`

• Confidence: 91% confidence
• Finding: `hf auth token` explicitly prints the current access token to stdout, which is highly sensitive in an agent environment where stdout may be logged, echoed back to users, or exposed to other tools. The surrounding skill text does not warn against using this command, so an agent could disclose reusable credentials and enable account compromise.

External Script Fetching

High

• Category: Supply Chain

Content

description: "Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`."
---

Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`.

The Hugging Face Hub CLI tool `hf` is available. IMPORTANT: The `hf` command replaces the deprecated `huggingface-cli` command.

• Confidence: 98% confidence
• Finding: The installation instruction pipes a remotely fetched script directly into `bash`, bypassing review, integrity verification, and normal package-management controls. In an agent or automated environment, this creates a straightforward remote code execution path if the delivery endpoint, network path, or script content is compromised.

External Script Fetching

Low

• Category: Supply Chain

Content

To mount Hub repositories or buckets as local filesystems — no download, no copy, no waiting — use `hf-mount`. Files are fetched on demand. GitHub: https://github.com/huggingface/hf-mount

Install: `curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh`

Some command examples:
- `hf-mount start repo openai-community/gpt2 /tmp/gpt2` — mount a repo (read-only)

• Confidence: 90% confidence
• Finding: This is another curl-to-shell pattern for `hf-mount`, again enabling execution of unreviewed remote code. It is somewhat less central because it is an optional adjunct tool, but in a skill context it still normalizes unsafe installation behavior and expands attack surface.

Static analysis

No suspicious patterns detected.