Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Hugging Face CLI reference, but users should be careful with tokens, uploads, and delete commands.
Install only if you intend to let the agent use Hugging Face account operations. Use a least-privilege HF_TOKEN, review files before any upload, confirm repository visibility, and require explicit approval before delete or broad upload commands.
The skill instructs users to set HF_TOKEN but does not warn that the token is a sensitive secret that grants access to Hugging Face resources. In an agent setting, this omission increases the risk of exposing credentials in shell history, logs, screenshots, prompts, or command arguments.
The skill includes hf repos delete as a normal example without any warning, confirmation guidance, or emphasis on irreversibility. In an agent skill context, destructive commands are more dangerous because users may treat examples as approved operational steps and accidentally delete remote repositories or data.
The skill documents multiple hf upload operations but does not warn that local files and directories will be transmitted to a remote third-party service. This is risky in an agent context because examples like uploading . can unintentionally publish sensitive source code, credentials, datasets, or proprietary artifacts.
No suspicious patterns detected.
