Hugging Face Datasets

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.10

Overview

The skill is mainly for Hugging Face dataset viewing, but it also includes write/upload workflows that could send sensitive local agent session history to Hugging Face.

Review this skill carefully before installing. Use its read-only Dataset Viewer endpoints only if that is what you need, and avoid the trace-upload workflow unless you have manually selected, reviewed, and redacted files in a staging directory. Do not upload whole agent session directories, and prefer a pinned or preinstalled Hugging Face CLI with a narrowly scoped token for any intended uploads.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:92

Finding

Bulk Upload of Sensitive Agent Session Data

Content

View full analysis

/ --type dataset --private --exist-ok hf upload / ~/.codex/sessions codex/ --type dataset ``` ``` ### Technical Analysis The Skill explicitly acknowledges that agent traces can contain secrets, personally identifiable information, prompts, local file paths, and tool outputs. Despite this, it recommends recursively uploading the complete `~/.codex/sessions` directory as raw JSONL data. A private repository only limits repository visibility. It does not prevent the sensitive information from being transmitted to and retained by an external service. The data may subsequently become accessible through repository collaborators, account compromise, service-side processing, logging, accidental visibility changes, or misconfiguration. This access exceeds the minimum privileges needed for the Skill's declared read-only Dataset Viewer workflows. Even when trace publishing is intentionally requested, unrestricted access to an entire session-history directory is broader than necessary. The operation lacks file-l ...[truncated 1535 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79

Finding

Unpinned Package Download and Execution Through npx

Content

View full analysis

``` - Upload parquet folder to a dataset repo (auto-creates repo if missing): ```bash npx -y @huggingface/hub upload datasets// ./local/parquet-folder data ``` - Upload as private repo on creation: ```bash npx -y @huggingface/hub upload datasets// ./local/parquet-folder data --private ``` ``` ### Technical Analysis The documented commands use `npx -y` to resolve, download, and execute `@huggingface/hub` without specifying an exact audited version or integrity value. The effective code can therefore change after the Skill has been reviewed. The `-y` option automatically accepts installation, reducing the opportunity for users to inspect the resolved package and version. Package execution occurs with the invoking user's privileges. In this workflow, the process may have access to `HF_TOKEN`, the local upload directory, the user's home directory, and network connectivity. If the package distribution, maintainer account, dependency chain, package registry, or local package-resolution environment is compromised, malicious installation or runtime code could abuse those privileges. The package name is consistent with the stated service, and the audited file does not prove that the current package is malicious. The vulnerability is the unsafe mutable dependency-execution pattern and the broad environment in which it is run. ### Attack Path 1. A user follows the documented upload workflow. 2. The user exports `HF_TOKEN` into the process environment. 3. `npx -y` resolves the package and its dependency graph at execution time. 4. A compromised or unexpectedly modified package version executes locally. 5. Package cod ...[truncated 965 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as a read-only Dataset Viewer API skill, but the documentation expands into dataset creation and upload workflows. This broadens the capability surface from passive data retrieval to authenticated write operations, increasing the chance of unintended data publication or misuse beyond the user's original expectation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill includes instructions to upload raw local agent session traces from directories like ~/.codex/sessions, which can contain prompts, secrets, file paths, tool outputs, and other sensitive data. This is unjustified for a Dataset Viewer exploration skill and creates a direct exfiltration path from local machine storage to a remote hosted dataset.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly claims the skill is for read-only Dataset Viewer API calls, then later provides instructions for creating repositories and uploading data. This mismatch can mislead users and higher-level agents about the skill's real capability, weakening trust boundaries and increasing the risk of unsafe invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

Zero local dependencies (Hub UI):

- Create dataset repo in browser: `https://huggingface.co/new-dataset`
- Upload parquet files in the repo "Files and versions" page.
- Verify shards appear in Dataset Viewer:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to execute npx @huggingface/hub without pinning a specific package version. This creates a supply-chain risk because the resolved package version can change over time or be compromised, causing different code to run than the skill author reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx -y @huggingface/hub executes an unpinned package from the registry, which exposes users to dependency drift and package compromise. In a skill context, this is especially risky because it normalizes direct execution of remote code as part of the documented workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This upload example again relies on npx -y @huggingface/hub without version pinning, creating a repeatable supply-chain execution path. If the package or one of its dependencies is malicious or unexpectedly updated, users may run attacker-controlled code while handling authenticated dataset operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The upload example for raw agent session traces appears without an explicit warning immediately before the command, even though those traces may contain secrets and personal data. In practice, users often copy-paste command blocks, so the absence of a strong localized warning materially increases the chance of accidental sensitive-data disclosure.

Content

No source excerpt is available for this finding.