hugging-face-object-detection-trainer
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFE
Full Analysis
- Remote Job Execution: The skill utilizes the
hf_jobsMCP tool andHfApi().run_uv_job()to execute training scripts on Hugging Face's managed GPU infrastructure. While this involves remote code execution, it is performed within a controlled, authenticated environment provided by the vendor. - Authentication Management: The skill provides clear instructions on handling sensitive access tokens (
HF_TOKEN). It emphasizes the use of job secrets for secure token injection and includes programmatic patterns to ensure tokens are explicitly passed to the training engine, minimizing the risk of unauthorized access to user repositories. - Data Processing Considerations: The skill ingests external datasets from the Hugging Face Hub via the
datasetslibrary. - Ingestion points: Datasets are loaded in
scripts/training.pyusingload_datasetbased on user-provided repository IDs. - Boundary markers: The training script expects structured data in COCO or Pascal VOC formats and performs coordinate validation.
- Capability inventory: The skill has the capability to submit remote training jobs and write results (model weights and configurations) back to the Hugging Face Hub.
- Sanitization:
scripts/training.pyincludes asanitize_datasetfunction that validates and clips bounding box coordinates to ensure they remain within image bounds, preventing training failures due to malformed spatial data. - External Service Integration: The skill integrates with
Trackiofor experiment monitoring and theDatasets Server APIfor metadata inspection. These are well-known services within the ecosystem, and their usage is documented for transparency and functionality.
Audit Metadata