hugging-face-object-detection-trainer

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFE
Full Analysis
  • Remote Job Execution: The skill utilizes the hf_jobs MCP tool and HfApi().run_uv_job() to execute training scripts on Hugging Face's managed GPU infrastructure. While this involves remote code execution, it is performed within a controlled, authenticated environment provided by the vendor.
  • Authentication Management: The skill provides clear instructions on handling sensitive access tokens (HF_TOKEN). It emphasizes the use of job secrets for secure token injection and includes programmatic patterns to ensure tokens are explicitly passed to the training engine, minimizing the risk of unauthorized access to user repositories.
  • Data Processing Considerations: The skill ingests external datasets from the Hugging Face Hub via the datasets library.
  • Ingestion points: Datasets are loaded in scripts/training.py using load_dataset based on user-provided repository IDs.
  • Boundary markers: The training script expects structured data in COCO or Pascal VOC formats and performs coordinate validation.
  • Capability inventory: The skill has the capability to submit remote training jobs and write results (model weights and configurations) back to the Hugging Face Hub.
  • Sanitization: scripts/training.py includes a sanitize_dataset function that validates and clips bounding box coordinates to ensure they remain within image bounds, preventing training failures due to malformed spatial data.
  • External Service Integration: The skill integrates with Trackio for experiment monitoring and the Datasets Server API for metadata inspection. These are well-known services within the ecosystem, and their usage is documented for transparency and functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 12:12 PM