Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Hugging Face CLI reference skill, but users should be careful with tokens, uploads, and delete commands.
Install only if you want an agent to help operate the Hugging Face CLI. Use a least-privilege Hugging Face token, avoid exposing tokens in commands or logs, review paths before upload, prefer explicit file paths over broad `.` uploads, verify repo visibility, and require confirmation before delete or move operations.
The skill requires an HF_TOKEN and mentions token-based authentication but does not warn users to protect credentials from shell history, logs, screenshots, or accidental inclusion in commands. In agent-assisted workflows, token mishandling can result in account compromise, unauthorized repository changes, or access to private models and datasets.
The skill documents a destructive hf repos delete command without any caution, confirmation guidance, or scoping advice. In an agent setting, this increases the risk of accidental deletion of valuable remote repositories or data, especially if a user asks for broad repo management and the agent treats deletion as a normal operation.
The skill encourages uploading local files and directories to Hugging Face, including . and whole folders, without warning about sensitive data exposure. In an agent context, this can lead to unintentional exfiltration of secrets, proprietary models, credentials, .git history, or personal data if the local path is broader than intended or the target repo visibility is misunderstood.
No suspicious patterns detected.
