hugging-face-dataset-viewer
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- External Package Execution: The skill utilizes
npxto download and execute packages such asparquetlensand the vendor's own@huggingface/hub. While this involves running external code at runtime, these tools are well-known and appropriate for the skill's primary purpose of querying and uploading dataset files. - Command Line Operations: The workflow relies on
curlfor API interactions and shell commands for file management and data exports (e.g., CSV/JSON/Parquet). These operations are standard for dataset processing but require that the user ensures input parameters are valid. - External Data Processing: The skill is designed to ingest and process content from external datasets. This creates a surface for indirect instructions to be processed by the agent. To maintain security, it is recommended to review the contents of datasets before performing automated operations on them.
- Authentication Management: The skill uses an environment variable (
HF_TOKEN) for accessing gated or private repositories. This is a secure alternative to hardcoding credentials, provided the environment itself is protected.
Audit Metadata