hugging-face-tool-builder
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- PROMPT_INJECTION (LOW): Indirect Prompt Injection Surface. The skill fetches and processes model cards (README.md) from Hugging Face repositories, which are user-controlled external sources. 1. Ingestion points:
hf downloadand API calls inhf_model_card_frontmatter.shandhf_model_papers_auth.shingest untrusted markdown files. 2. Boundary markers: Absent. Data is processed into script outputs without delimiters. 3. Capability inventory: Shell command execution (curl,hf), file system access, and network operations. 4. Sanitization: Partial; usesjqand regex but lacks logic to neutralize embedded instructions. - COMMAND_EXECUTION (LOW): Dynamic Execution via Embedded Scripts. The script
hf_model_card_frontmatter.shexecutes embedded Python code using heredocs. While the code is static and used for parsing, the pattern involves runtime interpretation of embedded source. - DATA_EXFILTRATION (LOW): Network operations to non-whitelisted domains. The skill performs multiple
curland API operations tohuggingface.co, which is not included in the predefined whitelist of trusted domains.
Audit Metadata