huggingface-llm-trainer

Pass

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • External Dependency Download: The scripts/convert_to_gguf.py script clones the llama.cpp repository from GitHub. This is a standard and necessary step for converting fine-tuned models into the GGUF format for local inference.
  • Subprocess Command Execution: The skill utilizes subprocess.run to interact with system tools such as git, cmake, and make. This is used to build the quantization tools required for model conversion and is performed within the isolated Hugging Face Jobs environment.
  • Credential Handling: The skill provides instructions for using HF_TOKEN as a secret for Hub authentication. This follows the platform's security best practices for ephemeral training environments to ensure models can be saved to the user's repository.
  • Remote Script Execution Workflow: The skill leverages the hf_jobs MCP tool to submit Python scripts for execution on cloud GPUs. The patterns used for script submission (inline code or resolution via Hub URLs) are standard for Hugging Face's managed training service.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 23, 2026, 10:18 PM