Trust Assessment
hugging-face-cli received a trust score of 40/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 3 findings: 1 critical, 2 high, 0 medium, and 0 low severity. Key findings include Arbitrary Command Execution via `hf jobs run`, Potential Data Exfiltration via `hf upload`, Destructive Capabilities and Broad System Access.
The analysis covered 4 layers: manifest_analysis, llm_behavioral_safety, static_code_analysis, dependency_graph. The static_code_analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 11, 2026 (commit 3f4f55d6). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary Command Execution via `hf jobs run` The skill exposes the `hf jobs run` command, which allows executing arbitrary commands (`<cmd>`) on cloud compute infrastructure. If an attacker can control the `<cmd>` argument, they can execute malicious code, leading to data exfiltration (including `HF_TOKEN` if passed via `--secrets`), resource abuse, or further system compromise. This is a direct command injection vulnerability. Implement strict input validation and sanitization for the `<cmd>` argument before passing it to `hf jobs run`. Consider using an allowlist of safe commands or sandboxing the execution environment. Avoid directly passing user-controlled input to this argument. | Unknown | SKILL.md:120 | |
| HIGH | Potential Data Exfiltration via `hf upload` The `hf upload` command allows uploading local files and directories to a Hugging Face repository. If an attacker can control the `<repo_id>` or the local paths specified for upload (e.g., `.` or `./models`), they could exfiltrate sensitive local data to a repository they control. This represents a direct data exfiltration vector. Implement strict input validation and sanitization for `<repo_id>` and local file paths. Ensure that only approved and non-sensitive files/directories can be specified for upload, and that the destination repository is legitimate and controlled by the intended user. | Unknown | SKILL.md:50 | |
| HIGH | Destructive Capabilities and Broad System Access The skill provides commands such as `hf repo delete`, `hf repo-files delete`, and `hf endpoints delete`, which allow for permanent deletion of resources on the Hugging Face Hub. Additionally, the `hf jobs run` command enables arbitrary code execution on cloud infrastructure, potentially with access to sensitive environment variables like `HF_TOKEN`. These broad and destructive capabilities, if misused or exploited via untrusted input, could lead to significant data loss, resource abuse, or unauthorized system access. Implement strict access controls and input validation for all commands, especially those with destructive potential or arbitrary code execution. Ensure that the agent only invokes these commands with highly trusted and verified parameters, and that user input cannot directly influence critical arguments like `repo_id`, file paths, or job commands. | Unknown | SKILL.md:80 |
Scan History
Embed Code
[](https://skillshield.io/report/07de8745b23ae49b)
Powered by SkillShield