hugging-face daily papers

Fetch and digest HuggingFace Daily Papers. Use when user asks for today's HF papers, daily paper digest, wants a paper report, or says 论文精选/今日论文/HF daily pap...

Security Scan

The skill largely does what it says (fetches HuggingFace daily papers and writes a digest), but the package metadata omits the HF_TOKEN requirement and a few minor dependency/manifest inconsistencies that you should understand before installing.

Purpose & Capability

Name/description match the behavior: the script fetches the HuggingFace daily papers feed and formats results. Requiring an HF read token is coherent with using the HF API. However, the registry metadata declared no required environment variables or primary credential while the runtime instructions and script explicitly require an HF_TOKEN — this metadata omission is inconsistent and worth flagging.

Instruction Scope

SKILL.md and SKILL_zh.md limit actions to fetching HF API data, cleaning it, scoring, and writing hf_results.json. The instructions do not request unrelated files, system-wide config, or unknown external endpoints. They do instruct the user to set HF_TOKEN in the environment; the Python script reads only that env var and writes a local hf_results.json.

Install Mechanism

There is no install spec (instruction-only skill with an included script). That is the lower-risk model. Note: the Python script depends on the 'requests' library and a Python runtime but the SKILL.md does not list these runtime dependencies; this is an operational omission (not an obvious security risk) but could cause failures.

Credentials

The script requires HF_TOKEN (a HuggingFace token) which is appropriate for calling the HF API. However, the skill registry metadata did not declare any required env vars or a primary credential—this mismatch is suspicious because users installing skills expect to see required credentials upfront. Recommend creating a minimal read-only token and verifying the token's scope before use.

Persistence & Privilege

The skill does not request permanent/always-on presence and does not modify other skills or system configs. It writes a single output file (hf_results.json) in the working directory. Autonomous invocation is allowed (platform default) but there are no additional elevated privileges requested.

What to consider before installing

This skill appears to be what it claims: it fetches HuggingFace daily papers and writes a local hf_results.json. Before installing, note two practical and one security point: (1) Metadata omission — the registry did not declare HF_TOKEN as a required credential even though SKILL.md and the script require it; expect to provide HF_TOKEN yourself. (2) Runtime dependency — the script uses the Python 'requests' library but the skill doesn't list this dependency; ensure you have Python + requests installed. (3) Token scope and trust — create a dedicated HuggingFace read-only token for this skill (do not reuse high-privilege tokens), and review the simple script contents (it only calls huggingface.co and writes a local JSON) — if you do not trust the skill source (owner unknown), run it in an isolated environment or container. If the owner can be verified, ask them to update registry metadata to declare HF_TOKEN and list runtime deps to remove the inconsistency.

HF Daily Papers

Fetch papers from HuggingFace Daily Papers feed and generate a digest with analysis.

Setup: Get Your HF Token

1. Go to https://huggingface.co/settings/tokens
2. Create a Read token (any name)
3. Set the token as an environment variable:

# Windows PowerShell
$env:HF_TOKEN = "hf_xxxxxxxxxxxxx"

# macOS / Linux / Git Bash
export HF_TOKEN="hf_xxxxxxxxxxxxx"

The script reads HF_TOKEN from os.environ. If not set, it exits with a clear error message.

Step 1: Run the fetcher

cd <skill-path>/scripts && python hf_papers.py [date YYYY-MM-DD]

• No date arg = yesterday
• Output: hf_results.json (saved in the working directory)

Step 2: Read results

Read hf_results.json. Fields:

Field	Description
paperId	arXiv ID
title	Paper title
votes	Community upvotes
submittedBy	Submitter name
organization	Research institution
summary	Full abstract (cleaned, up to 2000 chars)
aiSummary	AI-generated summary (200-300 chars, from HF blue box)
githubRepo	GitHub repo URL if available
keywords	AI-extracted keywords (up to 10)
link	HF paper page
arxivLink	arXiv abstract page

Step 3: Score and write digest

Scoring reference (10-point scale, intuition-based):

Dimension	Weight	Bonus signals
Innovation	0-3	New benchmark/dataset, novel direction, first-of-its-kind
Practicality	0-3	Has GitHub code, clear real-world application, big tech/academia
Technical depth	0-2	Summary >200 chars, contains RL/MCTS/evolutionary methods
Interestingness	0-2	Provocative thesis, cross-discipline, counterintuitive

High vote count (>10) is a bonus — reflects community heat.

Step 4: Output format

📄 HF Daily Papers · [date]  N papers total

## 🔴 Must Read (score 8-10)
[Title | ID | Organization
 Xiaolongxia comment: ...]
## 🟡 Worth Noting (score 6-7)
[Compact list + one-line evaluation]
## 🟢 Skim If Interested
[Ultra brief list]

## 🦞 Summary
Top 3 + today's main theme observations

Commentary guidelines:

• Every "Must Read" paper needs a "Xiaolongxia comment" — explain the core insight in your own words
• Say why it's worth reading and what makes it special
• Can connect to other papers or industry trends
• Tone: casual, witty, friendly — like chatting with a friend
• "Worth Noting" entries: one sentence max