ClawHub
Back to skill

Security audit

Hugging Face Spaces

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Hugging Face Spaces deployment guide, with expected cloud-write and credential handling requirements that users should treat carefully.

Install only if you intend to let your agent manage Hugging Face Spaces. Use `hf auth login` or Space secrets for tokens, avoid pasting write tokens into prompts or files, and confirm any paid hardware, bucket creation, visibility setting, or public posting before the agent runs those commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation description is broad enough to trigger on generic app-hosting or deployment requests, which can cause the agent to apply Hugging Face Spaces-specific guidance in contexts the user did not intend. Overbroad activation increases the chance of inappropriate tool use, unnecessary credential prompts, or mis-scoped actions against the wrong platform.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs the user to obtain and use a write-scoped Hugging Face token but does not clearly warn that this credential grants repository-modification capabilities and must be treated as sensitive. In an agent-assisted workflow, that omission can lead users to over-share the token, store it insecurely, or provide broader access than necessary.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.