huggingface-best

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Local Authentication Management: The skill reads an authentication token from the local directory (~/.cache/huggingface/token) to authorize requests to the platform's API. This is a standard method for managing identity and rate limits when interacting with official services.
  • Evidence: Use of $(cat ~/.cache/huggingface/token) in SKILL.md.
  • System Command Execution: The skill utilizes standard command-line tools like curl, jq, and the platform's CLI (hf) to fetch and parse model information. These operations are limited to the platform's official domains and are used for their intended purpose of data retrieval.
  • Evidence: Shell commands for curl and hf models info in SKILL.md.
  • External Content Processing: The skill aggregates data from external sources such as model leaderboards and metadata. While this is a common pattern for information retrieval, it is a point where the agent processes content that is influenced by third parties.
  • Ingestion points: API responses from huggingface.co containing model metadata and leaderboard stats in SKILL.md.
  • Boundary markers: Content is parsed from JSON and presented in Markdown tables, though explicit instructions to ignore embedded prompts are not present.
  • Capability inventory: The skill uses shell execution to interact with the platform and parse results using jq in SKILL.md.
  • Sanitization: Data is structured via JSON parsing and formatted into static table templates before display.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 01:40 PM