The Agent Skills Directory

[SAFE]: The skill exclusively targets official and well-known Hugging Face API and Inference domains for all functionality.
[COMMAND_EXECUTION]: Provides structured templates for using curl and jq to perform API operations. It includes guidance on using bash -c to maintain environment variable integrity during piped execution.
[CREDENTIALS_UNSAFE]: Leverages a platform-managed secret HUGGING_FACE_TOKEN for authentication, avoiding hardcoded keys or insecure exposure of credentials.
[PROMPT_INJECTION]: The skill ingests user input for search queries and inference messages, creating a surface for indirect prompt injection. Ingestion points: User-provided strings are placed into API request templates in SKILL.md. Boundary markers: None explicitly implemented in the provided shell templates. Capability inventory: Includes network access via curl, shell execution via bash, and file writing to /tmp. Sanitization: Recommends using temporary JSON files for request bodies to mitigate potential shell-injection risks.

hugging-face