Hugging Face CLI

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:23 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward Hugging Face CLI helper, but users should handle their Hugging Face token carefully.

Install only if you intend to let Codex help manage Hugging Face resources. Use a read-only token for browsing or downloads, create a separate narrowly scoped write token only when needed, avoid putting HF_TOKEN in a shell profile unless you accept the plaintext-storage risk, and review destructive hf commands before confirming them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–28
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

pip install -U "huggingface_hub[cli]"
# or
brew install hf

Technical Analysis

The installation instructions retrieve a mutable, unpinned version of the Hugging Face CLI. The pip install -U command explicitly upgrades to the newest release available at execution time, while the Homebrew command similarly installs the formula version current at that time.

This means the installed code can differ from the version considered during this audit. No evidence indicates that the named package or Homebrew formula is currently malicious; however, the instructions do not provide version constraints, integrity hashes, or a lock file that would protect users against a compromised or unexpectedly modified future release.

Attack Path

1. An attacker compromises a relevant package release, maintainer account, distribution infrastructure, or upstream dependency.
2. A user follows the Skill's installation instructions after the compromised release becomes current.
3. pip install -U or Homebrew retrieves the changed package and its dependencies.
4. Malicious installation-time or runtime code executes with the privileges of the user running the installation.
5. The malicious code may access local files, environment variables such as HF_TOKEN, and resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The reachable scope may include the user's local files, Hugging Face bearer token, repositories accessible by that token, and other credentials available in the process environment. System-wide impact would depend on whether installation is performed with elevated privileges, which the Skill does not explicitly request.

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a version that has been reviewed and tested, rather than automatically installing the latest release.
• For pip-based installation, use a locked requirements file with cryptographic hashes and install with --require-hashes.
• Install the CLI in an isolated virtual environment or managed tool environment instead of the global Python environment.
• Document an explicit upgrade and review procedure rather than using -U by default.
• Avoid elevated installation privileges unless they are strictly necessary.
• Where practical, verify package provenance, release signatures, and the configured package index before installation.

Example hardened workflow:

bash

python -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Bearer Token Recommended for Plaintext Shell-Profile Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 43
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

text

3. Set it as an environment variable: `export HF_TOKEN="hf_..."` (add to shell profile for persistence)

Technical Analysis

The Skill recommends adding the HF_TOKEN bearer credential directly to a shell profile for persistence. Files such as .bashrc and .zshrc ordinarily store their contents as plaintext and may be copied into backups, synchronization systems, troubleshooting bundles, or dotfile repositories.

Although the Skill separately warns users not to expose or log the token, that warning does not protect a credential placed directly in a persistent plaintext configuration file. Any process or person able to read the profile can recover the token without needing to know the user's Hugging Face password.

Attack Path

1. A user adds export HF_TOKEN="hf_..." to a shell startup file as recommended.
2. The shell profile is read by a malicious local process, exposed through insecure file permissions, included in a backup, synchronized to another system, or accidentally committed to a dotfile repository.
3. An attacker extracts the bearer token from the plaintext file.
4. The attacker supplies the token to the Hugging Face API or CLI.
5. The attacker performs operations permitted by the token until it expires or is revoked.

Impact Assessment

The resulting privileges are limited by the token's scope. A read token may expose private models, datasets, Spaces, repository metadata, or other private resources available to the account. A write-capable token may allow uploads, repository changes, job execution, endpoint administration, discussion management, or destructive operations where authorized. Compromise does not inherently provide broader operating-system privileges, but exposed hosted resources and associated usage costs could be affected.

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to place the token directly in a shell startup file.
• Store persistent credentials in an operating-system credential manager or an approved secret-management service.
• Inject the token into the process environment only when required, without printing it or writing it to command history.
• Use narrowly scoped, read-only tokens for read operations and separate write tokens only when modification is required.
• Prefer short-lived or regularly rotated credentials where supported.
• Ensure any temporary secret file is excluded from version control and protected with owner-only permissions.
• Document immediate token revocation and rotation procedures for suspected exposure.
• Add automated secret scanning to repositories that may contain user dotfiles or configuration exports.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

# Authentication

A Hugging Face User Access Token is required. The token is provided via the `HF_TOKEN` environment variable.

If authentication fails or the token is missing, instruct the user to:
1. Go to https://huggingface.co/settings/tokens

Static analysis

No suspicious patterns detected.