Hugging Face LoRA Space Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.10

Overview

The skill matches its LoRA Space publishing purpose, but it asks users to expose powerful Hugging Face tokens and can deploy mutable external code.

Review this before installing. Prefer an existing Hugging Face login or a secure secret store instead of pasting tokens into chat. Use fine-grained, least-privilege tokens: one restricted write token for publishing the target Space and a separate read-only token for private or gated model downloads if runtime access is needed. Pin Git dependencies to reviewed commit SHAs and vendor or integrity-pin any external browser scripts before making a Space public.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:194

Finding

Unpinned Git Dependencies Permit Mutable Build-Time Code Execution

Content

View full analysis

Remediation

View remediation

git+https://github.com/Lightricks/LTX-Video.git@ ``` 2. Make commit pinning mandatory in `SKILL.md`, rather than only recommending it in the LTX troubleshooting notes. 3. Prefer signed, versioned package releases from a trusted package index when they contain the required pipeline. 4. Record the selected commit and reason for using it in the generated README or deployment metadata. 5. Review upstream release notes and source changes before updating a pin. 6. Use dependency hashes where the installation mechanism supports them. 7. Rebuild and smoke-test the Space after every intentional dependency update. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:353

Finding

Reusable Hugging Face Token Is Exposed Through Chat and Process Arguments

Content

View full analysis

I need a Hugging Face access token with **write** scope (to read the LoRA if it's private/gated, and to publish the Space). Create one at https://huggingface.co/settings/tokens. Paste it here. The same token will be reused for publishing in the final phase, so this is a one-time ask. ``` Runtime secret configuration: ```python api.add_space_secret(repo_id=repo_id, key="HF_TOKEN", value=HF_TOKEN) ``` ```text …and in `app.py`, load the LoRA with `token=os.environ["HF_TOKEN"]`. ``` Command-line token use: ```text **Step 2 — Verify the endpoint signature.** `gradio info {repo_id} --token {hf_token}` returns the exposed endpoints and their parameter types. ``` ```bash # Text-to-image: gradio predict {repo_id} /predict '{"prompt": "...", "aspect_ratio": "1:1", ...}' --token $HF_TOKEN # Image-to-image (file input): gradio predict {repo_id} /predict '{"input_image": {"path": "/tmp/sample.jpg", "meta": {"_type": "gradio.FileData"}}, "prompt": "..."}' --token $HF_TOKEN ``` ### Technical Analysis Requesting that a user paste a reusable write-capable token into chat places the credential in conversation history and potentially in API, application, or observability logs. Passing the token with `--token` also expands it into the child process argument vector, where it may be visible to local process inspection, debugging tools, shell tracing, command logging, or crash reports. The same write-scoped token may also be installed as a Space runtime secret when the deployed application only needs to read a private or gated model. This is broader than the runtime's minimum required privilege. A compromised application process could theref ...[truncated 1494 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/creative-mode.md:68

Finding

Externally Hosted Browser Script Executes Without Integrity Verification

Content

View full analysis

' css = '.fillable {max-width: 1200px !important}' demo.launch(head=head, css=css) ``` The accompanying instructions state: ```text Use the highest-quality CDN you can (cdnjs, jsdelivr, unpkg). Pin the version (`/three.js/r128/`, not `/three.js/latest/`). Loading from the LoRA author's personal server is a recipe for the Space breaking when their server moves. ``` ### Technical Analysis The versioned CDN path improves reproducibility, but the example does not use Subresource Integrity and does not require the JavaScript asset to be vendored locally. The user's browser therefore trusts whatever script is returned by the CDN at page-load time. JavaScript injected through `demo.launch(head=...)` executes in the browser context of the Space interface. It can interact with the DOM, custom widget state, prompts, uploaded media represented in browser memory, and network APIs. A compromised CDN account, origin, or delivery path could consequently turn a legitimate UI dependency into client-side malicious code. The external script is only necessary when a complex custom interface genuinely requires that library. It exceeds minimum privilege for interfaces that can be implemented with stock Gradio controls, SVG, or native canvas code. ### Attack Path 1. A generated Space includes the externally hosted script tag. 2. A user opens the Space in a browser. 3. The browser retrieves the script from the CDN without validating an expected cryptographic digest. 4. The CDN response is maliciously modified or the hosted asset is compromised. 5. The browser executes the modified JavaScript in the Space UI context. 6. The script reads accessible UI state or uploaded media and send ...[truncated 619 chars]

Remediation

View remediation

" crossorigin="anonymous"> ``` 4. Verify the integrity digest against a trusted release source before deployment. 5. Apply a restrictive Content Security Policy that permits scripts only from explicitly approved origins and restricts outbound connections with `connect-src`. 6. Avoid placing secrets or unnecessary sensitive data in browser-accessible state. 7. Include a browser-level smoke test and dependency review whenever external frontend assets are changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

These instructions normalize direct credential collection and reuse of a high-privilege token obtained via chat. A write-capable token can be abused to read gated content, create or alter Spaces/repos, and potentially pivot into supply-chain or account-impacting actions if the token is leaked or misused.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Requesting a write-scoped access token directly in chat is a credential-access anti-pattern. Because the token grants sensitive capabilities beyond simple read access, compromise of the chat or any connected tooling could lead to unauthorized repository writes, private model access, or persistent misuse.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

When asking for a token (and only when you actually need to ask):

> I need a Hugging Face access token with **write** scope (to read the LoRA if it's private/gated, and to publish the Space). Create one at https://huggingface.co/settings/tokens. Paste it here.

The same token will be reused for publishing in the final phase, so this is a one-time ask.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to ask the user to paste a write-scoped Hugging Face access token into chat. Collecting secrets through chat is unsafe because chat transcripts may be logged, retained, exposed to other tools, or mishandled by downstream systems, and the requested write scope enables repository creation and modification.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs taking a token previously pasted into chat and installing it as a Space secret, compounding the initial exposure by persisting and reusing a secret acquired insecurely. This increases the blast radius because a compromised or mishandled token can continue granting access at runtime to private/gated models and publishing actions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The document explicitly instructs the agent to ask the user to paste a Hugging Face access token with write scope into the conversation when no cached auth exists. Requesting high-privilege credentials through chat is dangerous because the token may be exposed in logs, transcripts, model context, or downstream tooling, and a write-scoped token can be abused to modify or publish repositories and Spaces.

Content

Scanner excerpt · references/zerogpu-and-publishing.md (reported line 74)May include surrounding context.

md

- **User already authenticated and the LoRA repo is public**: use the existing token. Confirm the username with the user before publishing ("I'll publish to `{username}` — confirm?").
- **User already authenticated and the LoRA repo is private**: try `api.repo_info(repo_id, token=cached)`. If it succeeds, the existing token has the right scope — proceed. If it fails (token doesn't have access to that repo), ask for a token with broader access.
- **No cached token**: ask the user. One ask, with the explanation: "I need a Hugging Face access token with **write** scope. Create one at https://huggingface.co/settings/tokens. Paste it here." The same token will be reused for publishing.

The default flow on a Hugging Face Space, in a logged-in user's local environment with `huggingface-cli login`, or in any environment with `HF_TOKEN` set, will *not* require asking the user for a token. Asking is the fallback, not the default.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill when someone asks to create, generate, ship, or publish a Space, demo, Gradio app, or playground, then appends the LoRA qualifier later. Those verbs and artifact names are common everyday requests, so the activation scope is broad enough to collide with many non-LoRA app-building tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown instructs to use the skill whenever someone asks to create, generate, ship, or publish a Space, demo, Gradio app, or playground for a LoRA, and also when they merely describe a LoRA they want to share. It does not provide explicit boundaries or negative examples, making it unclear when adjacent requests should not trigger the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly recommends cloning and performing editable installs from GitHub at runtime in app.py, which executes remote code during Space startup. In this skill's context, the repositories and commits may be influenced by model-card examples or user-provided LoRA guidance, so an unpinned or insufficiently vetted install path can lead to supply-chain compromise or arbitrary code execution in the build/runtime environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly recommends injecting third-party JavaScript into the page via demo.launch(head=...) from public CDNs such as cdnjs/jsdelivr/unpkg. In the context of a skill that builds and publishes Hugging Face Spaces for users, this creates a real supply-chain and client-side code execution risk: compromised CDN assets, malicious package versions, or unsafe library choices would execute in every visitor’s browser, and the guidance does not require integrity pinning, self-hosting, or a trust review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/zerogpu-and-publishing.md (reported line 102)May include surrounding context.

md

Many LoRA repos contain a single `.safetensors` file and the choice is trivial. But some contain several — variants (4-step / 8-step distillations, FP16 vs BF16, different ranks), training-history checkpoints (`epoch-10.safetensors`, `epoch-20.safetensors`), or genuinely different methods (`lora.safetensors` + `lora_dora.safetensors`). Pick in this order, stopping at the first match:

1. **The README recommends a specific file.** This is the strongest signal — if the author bothered to name a file, that's the choice. Look for filenames inside inference snippets (especially `weight_name="..."` arguments), in "recommended" or "best" callouts, in comparison tables ranking variants, or in any prose like "use X for Y." If the README clearly points at one file, use it without asking.

2. **No README recommendation, and `pytorch_lora_weights.safetensors` exists at the repo root.** Use it. This is the diffusers convention and a safe default.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md

# Upload files
for path in ["app.py", "requirements.txt", "README.md"]:
    api.upload_file(
        path_or_fileobj=path,
        path_in_repo=path,
        repo_id=repo_id,

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/zerogpu-and-publishing.md (reported line 142)May include surrounding context.

md

# Upload files
for path in ["app.py", "requirements.txt", "README.md"]:
    api.upload_file(
        path_or_fileobj=path,
        path_in_repo=path,
        repo_id=repo_id,

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/creative-mode.md (reported line 57)May include surrounding context.

gr.HTML for arbitrary markup

Drop any HTML into the page. The block becomes a regular Gradio component, but its content is whatever you write. You're responsible for everything inside it: layout, styling, interactivity.

python

gr.HTML("""

Static analysis

No suspicious patterns detected.