ClawHub

Openclaw Huggingface

v1.0.0

Manage models, datasets, Spaces, and repositories using Hugging Face CLI (hf). Supports authentication, upload, download, Space creation, and more.

⭐ 0· 352·1 current·1 all-time
byXuan-You Lin@tsukisama9292
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the actual requirements: the skill needs the 'hf' CLI and HF_TOKEN to operate on Hugging Face models, datasets, Spaces, and repos. Nothing requested appears unrelated to the stated functionality.
✓
Instruction Scope
SKILL.md contains concrete hf CLI commands (auth, models, datasets, repos, spaces, upload/download). Commands reference local paths only when doing uploads/downloads, which is expected. The instructions do not ask the agent to read unrelated system files or to transmit data to endpoints outside Hugging Face CLI's normal behavior.
✓
Install Mechanism
There is no install spec (instruction-only). That minimizes risk — the skill does not download or write code to disk. It expects the user/host to provide the official 'hf' binary.
✓
Credentials
Only HF_TOKEN is required, which is the expected credential for interacting with the Hugging Face Hub. No unrelated secrets, keys, or config paths are requested. The docs note you can alternatively pass --token, which is consistent.
✓
Persistence & Privilege
The skill is not always-on and does not request elevated persistence or modify other skills/configs. Autonomous model invocation remains possible (platform default) but is not combined with additional concerning privileges.
Assessment
This skill is essentially documentation for the official Hugging Face CLI. Before installing/use: (1) ensure you have the official 'hf' CLI binary installed (verify vendor/source) so commands run against the real tool; (2) provide an HF_TOKEN with least-privilege scopes needed (avoid a fully-scoped or long-lived token if not necessary); (3) be careful when running upload commands to avoid unintentionally publishing private data or large files; and (4) keep the hf CLI updated to avoid using a compromised client binary.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c3x0jxz2tqrs8vwcs5apczs81z1n6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🤗 Clawdis
Binshf
EnvHF_TOKEN

Comments