hugging-face-cli

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
3
Flagged
3
Chunks
7
Flagged Files (3)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md Description: --- name: hugging-face-cli description: Execute Hugging Face Hub operations using the `hf` CLI.

references/commands.mdHIGH
78.3%

Tool passed security scan

Malicious tool definition detected

```bash hf cache verify gpt2 hf cache verify gpt2 --revision refs/pr/1 hf cache verify karpathy/fineweb-edu-100b-shuffle --repo-type dataset hf cache verify deepseek-ai/DeepSeek-OCR --local-dir /path/to/repo ``` **Options:** | Option | Description | |--------|-------------| | `--repo-type` | `model`, `dataset`, or `space` | | `--revision` | Revision to verify | | `--cache-dir` | Cache directory to use | | `--local-dir` | Verify files from a local directory | | `--fail-on-missing-files` | Error i

```bash hf env ``` **Output includes:** - huggingface_hub version - Platform and Python version - Token status - Cache paths - Relevant environment variables ### hf version Print CLI version.

references/examples.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/examples.md [1/2] Description: # HF CLI Common Workflows & Examples Practical examples for common Hugging Face Hub tasks.

Tool: references/examples.md [2/2]

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
3
Files Flagged
3
Chunks Analyzed
7
Analyzed
Feb 21, 2026, 08:48 AM
Security Audit — runlayer — hugging-face-cli