Huggingface Trends
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: huggingface-trends Version: 1.0.0 The skill is classified as suspicious due to a critical arbitrary file write vulnerability in `scripts/hf_trends.py` where the `output_file` parameter for JSON export is not sanitized, allowing for potential path traversal. Additionally, the `SKILL.md` explicitly instructs the AI agent to set up a cron job for daily monitoring, which, while used for a benign purpose in this context, demonstrates a persistence capability that could be exploited. There is no clear evidence of intentional malicious activity like data exfiltration to external C2 servers or unauthorized remote code execution.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may not run until the Python 'requests' package is installed.
The skill relies on a manually installed PyPI dependency rather than a declared install spec. This is common for a Python HTTP client and aligns with the purpose, but users should install dependencies from a trusted environment.
pip install requests
Install dependencies in a trusted Python environment, preferably a virtual environment, and avoid installing unrelated packages.
If you use the proxy option, your Hugging Face API requests are routed through that proxy.
The documentation repeatedly recommends routing requests through a proxy. This is disclosed and purpose-aligned, but the proxy can observe connection metadata and may affect responses.
The script requires an HTTP proxy to access Hugging Face API ... scripts/hf_trends.py -p http://172.28.96.1:10808
Use only a proxy you trust, and omit the proxy flag if your environment can access Hugging Face directly.
If you choose to add the cron job, the skill will run on a schedule and write log output.
The skill includes a user-directed cron example for repeated daily execution. The included code does not install this automatically, and daily monitoring is aligned with the stated purpose.
# Create cron job for daily monitoring 0 9 * * * cd /home/ltx/.openclaw/workspace && \
Only create the cron job if you want ongoing monitoring, and remove or edit it when no longer needed.