ClawHub

Huggingface

v1.0.2

Manage models, datasets, Spaces, and repositories using Hugging Face CLI (hf). Supports authentication, upload, download, Space creation, and more.

⭐ 1· 712·11 current·11 all-time
byXuan-You Lin@tsukisama9292
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the requirements: it needs the 'hf' CLI and HF_TOKEN to manage models, datasets, Spaces, and repos. Requesting the Hugging Face token and the hf binary is expected for this functionality.
✓
Instruction Scope
SKILL.md only contains hf CLI commands and examples for uploading/downloading/managing repos, Spaces, collections, and tokens. It does not instruct the agent to read unrelated system files, other env vars, or to contact endpoints outside Hugging Face.
✓
Install Mechanism
No install spec and no code files — the skill is instruction-only, which minimizes on-disk execution risk. It assumes the hf CLI is already installed by the user/environment.
✓
Credentials
The only required environment variable is HF_TOKEN, which is appropriate for a CLI that authenticates to Hugging Face. Note: HF_TOKEN is sensitive (it can grant access to your account); using a least-privilege token or a separate token for automation is recommended.
✓
Persistence & Privilege
The skill is not always-enabled and uses default invocation settings. It does not request persistent installation or modify other skills or system-wide settings.
Assessment
This skill is an instruction-only helper for the official Hugging Face CLI and appears coherent. Before installing or using it: ensure the 'hf' binary on your system is the official CLI (installed from Hugging Face docs or a trusted package manager), do not paste a high-privilege HF_TOKEN into shared environments, prefer a scoped/minimal token for automation, and be careful with destructive commands (hf repos delete, hf repos move, hf upload with overwrite) since they operate on your account. Because the skill contains no code, the security depends on the installed 'hf' binary and the token you provide—verify those before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk975dzhw8nb7wjb2av9z28kqfn81zpx2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🤗 Clawdis
Binshf
EnvHF_TOKEN

Comments