huggingface-best
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Local Authentication Management: The skill reads an authentication token from the local directory (
~/.cache/huggingface/token) to authorize requests to the platform's API. This is a standard method for managing identity and rate limits when interacting with official services. - Evidence: Use of
$(cat ~/.cache/huggingface/token)inSKILL.md. - System Command Execution: The skill utilizes standard command-line tools like
curl,jq, and the platform's CLI (hf) to fetch and parse model information. These operations are limited to the platform's official domains and are used for their intended purpose of data retrieval. - Evidence: Shell commands for
curlandhf models infoinSKILL.md. - External Content Processing: The skill aggregates data from external sources such as model leaderboards and metadata. While this is a common pattern for information retrieval, it is a point where the agent processes content that is influenced by third parties.
- Ingestion points: API responses from
huggingface.cocontaining model metadata and leaderboard stats inSKILL.md. - Boundary markers: Content is parsed from JSON and presented in Markdown tables, though explicit instructions to ignore embedded prompts are not present.
- Capability inventory: The skill uses shell execution to interact with the platform and parse results using
jqinSKILL.md. - Sanitization: Data is structured via JSON parsing and formatted into static table templates before display.
Audit Metadata