Security Audit
huggingface-lora-space-builder
github.com/huggingface/skillsTrust Assessment
huggingface-lora-space-builder received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 0 high, 1 medium, and 0 low severity. Key findings include Insecure Credential Acquisition via Chat Prompt.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on October 1, 2026 (commit 80f9fa53). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Insecure Credential Acquisition via Chat Prompt The skill instructs the agent to ask the user to paste a Hugging Face access token with 'write' scope directly into the chat interface. Chat histories are often logged, cached, or transmitted to external LLM providers, exposing these highly sensitive credentials to unauthorized access. Modify the instructions to direct the user to set the `HF_TOKEN` environment variable in their environment or use the Hugging Face CLI, rather than pasting the token directly into the chat. | LLM | SKILL.md:55 |
Scan History
Embed Code
[](https://skillshield.io/report/4aee532a0a51e5e2)
Powered by SkillShield