Hugging Face Spaces

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.0.10

Overview

The skill mostly matches its Hugging Face Spaces purpose, but it includes deployment guidance that could run unverified third-party code and create weak SSH access if followed.

Install only if you are comfortable with the agent managing Hugging Face Spaces on your behalf. Confirm before it creates public resources, uses paid hardware or buckets, posts discussions, enables dev mode, or handles tokens. For generated apps, pin Git dependencies to reviewed commits, prefer verified package sources, add hashes for direct wheels, and use passphrase-protected SSH keys unless you explicitly accept the tradeoff.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/requirements.md:39

Finding

Unpinned Remote Git Package Installed at Application Runtime

Content

View full analysis

Remediation

View remediation

``` 2. Prefer an official, versioned package release when one is available. 3. Build the dependency into a wheel through a controlled CI pipeline. 4. Publish the wheel to a trusted artifact repository and verify it with a SHA-256 hash. 5. Install dependencies during the image build rather than from `app.py`. 6. Use a lockfile or hash-enforced requirements file for all direct and transitive dependencies. 7. Review and explicitly pin the runtime dependencies omitted by `--no-deps`. 8. Run the application with a minimally scoped token and without unnecessary mounted storage. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/requirements.md:68

Finding

Unverified Community-Hosted Native CUDA Wheels

Content

View full analysis

``` ```text # requirements.txt numpy einops https://huggingface.co/datasets/multimodalart/zerogpu-blackwell-wheels/resolve/main/wheels/pt212-cu130-cp310/flash_attn-2.8.3-cp310-cp310-linux_x86_64.whl https://huggingface.co/datasets/multimodalart/zerogpu-blackwell-wheels/resolve/main/wheels/pt212-cu130-cp310/xformers-0.0.34+3da0fc92.d20260528-cp39-abi3-linux_x86_64.whl ``` ### Technical Analysis The Skill recommends installing precompiled native CUDA wheels from a community-owned Hugging Face dataset. The URLs resolve through the mutable `main` revision and do not include: - An immutable repository commit or revision. - A SHA-256 package hash. - A cryptographic signature. - Verifiable build provenance. - Reproducible-build documentation. Native Python wheels can contain shared libraries and machine code that execute during package import. A filename containing a version does not guarantee immutability when the enclosing URL points to a mutable branch. Describing the dataset as canonical may cause users or agents to trust it as if it were an official, integrity-protected package source, despite the absence of verification controls in the documented installation pattern. ### Attack Path 1. An attacker compromises the community dataset owner, a maintainer account, or the repository itself. 2. The attacker replaces a wheel under the mutable `main` revision while retaining the expected filename. 3. A Space rebuild installs dependencies from the documented direct URL. 4. Pip downloads the replacement because no immutable revision or expected digest is enforced. 5. Malicious native code executes during ins ...[truncated 948 chars]

Remediation

View remediation

--hash=sha256: ``` 4. Enable `--require-hashes` for the complete requirements file. 5. Document the source commit, compiler, CUDA toolkit, PyTorch version, and build procedure for each wheel. 6. Rebuild sensitive native packages through a controlled CI pipeline where feasible. 7. Verify signatures or attestations when supplied by the upstream project. 8. Periodically audit repository ownership and compare stored hashes before updating a pinned wheel. 9. Use minimally scoped Space tokens to reduce the impact of a compromised dependency. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/debugging.md:168

Finding

SSH Key Generation Guidance Creates an Unencrypted Private Key

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

**B. Logs clean post-boot?** Read the run log to confirm startup finished without warnings or silent fallbacks:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description contains broad activation criteria such as using it whenever the user asks to create or host an app on Hugging Face or otherwise work with several related tools. Overly broad triggers can cause the agent to invoke this skill in loosely related situations, increasing the chance that high-impact operational guidance involving auth, deployment, secrets, or paid resources is applied when not necessary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/debugging.md (reported line 179)May include surrounding context.

No huggingface_hub Python wrapper yet — use the REST endpoint:

bash

curl -s -X POST \
  -H "Authorization: Bearer $HF_TOKEN" \
  -H "Content-Type: application/json" \
  "https://huggingface.co/api/spaces/<ns>/<space>/dev-mode" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example shows programmatic posting with a hard-coded access token placeholder and does not warn that the call creates a public discussion on the Space. In an agent skill context, this can lead to unsafe credential handling patterns or cause the agent to perform an externally visible action without adequately informing the user, even if the snippet is only instructional.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/requirements.md (reported line 59)May include surrounding context.

Verification after pip install or uv lock --upgrade:

bash

curl -s https://pypi.org/pypi/<pkg>/<version>/json \
  | python3 -c "import json,sys,re; rd=json.load(sys.stdin)['info'].get('requires_dist') or []; \
                print('\n'.join(x for x in rd if re.match(r'^torch(?![a-z])', x)) or '(no torch constraint)')"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/requirements.md (reported line 101)May include surrounding context.

text

# requirements.txt
numpy
einops
https://huggingface.co/datasets/multimodalart/zerogpu-blackwell-wheels/resolve/main/wheels/pt212-cu130-cp310/flash_attn-2.8.3-cp310-cp310-linux_x86_64.whl
https://huggingface.co/datasets/multimodalart/zerogpu-blackwell-wheels/resolve/main/wheels/pt212-cu130-cp310/xformers-0.0.34+3da0fc92.d20260528-cp39-abi3-linux_x86_64.whl

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/requirements.md (reported line 102)May include surrounding context.

text

# requirements.txt
numpy
einops
https://huggingface.co/datasets/multimodalart/zerogpu-blackwell-wheels/resolve/main/wheels/pt212-cu130-cp310/flash_attn-2.8.3-cp310-cp310-linux_x86_64.whl
https://huggingface.co/datasets/multimodalart/zerogpu-blackwell-wheels/resolve/main/wheels/pt212-cu130-cp310/xformers-0.0.34+3da0fc92.d20260528-cp39-abi3-linux_x86_64.whl

Static analysis

No suspicious patterns detected.