Versioned security assessment

Report ID: SA-88A8E9A0

7/24/2026, 12:31:59 AM

hugging-face-jobs security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
hugging-face-jobs
Version
v5
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/hugging-face-jobs
Coverage
9 Files scanned · 4,871 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are detector noise from Markdown, documentation URLs, safe environment access, and ordinary API examples. Confirmed risks involve exposed tokens and mutable remote code; semantic review also found unpinned images and missing approval gates for paid jobs.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 4,871 Lines analyzed

16 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Observed in 43 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 47 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (13)
High
references/troubleshooting.md:190
Hardcoded URL
hf_jobs("uv", {"script": "https://huggingface.co/user/repo/resolve/main/script.py"})
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/cot-self-instruct.py:44
Shell command substitution
-e HF_TOKEN=$(python3 -c "from huggingface_hub import get_token; print(get_token())") \\
The example expands the local HF token into a command-line environment argument. The token can be exposed through process listings, shell tracing, or copied command output.
High
scripts/cot-self-instruct.py:707
Shell command substitution
-e HF_TOKEN=$(python3 -c "from huggingface_hub import get_token; print(get_token())") \\
The example expands the local HF token into a command-line environment argument. The token can be exposed through process listings, shell tracing, or copied command output.
High
scripts/cot-self-instruct.py:45
Hardcoded URL
https://huggingface.co/datasets/uv-scripts/synthetic-data/raw/main/cot-self-instruct.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/cot-self-instruct.py:431
Hardcoded URL
uv run https://huggingface.co/datasets/uv-scripts/synthetic-data/raw/main/cot-self-instruct.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/cot-self-instruct.py:708
Hardcoded URL
https://huggingface.co/datasets/uv-scripts/synthetic-data/raw/main/cot-self-instruct.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/finepdfs-stats.py:34
Hardcoded URL
https://huggingface.co/datasets/uv-scripts/dataset-stats/raw/main/finepdfs-stats.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/finepdfs-stats.py:276
Hardcoded URL
uv run https://huggingface.co/datasets/uv-scripts/dataset-stats/raw/main/finepdfs-stats.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/finepdfs-stats.py:554
Hardcoded URL
" https://huggingface.co/datasets/uv-scripts/dataset-stats/raw/main/finepdfs-stats.py \\"
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/generate-responses.py:155
Hardcoded URL
uv run https://huggingface.co/datasets/uv-scripts/vllm/raw/main/generate-responses.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
scripts/generate-responses.py:580
Hardcoded URL
https://huggingface.co/datasets/uv-scripts/vllm/raw/main/generate-responses.py \\
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
SKILL.md:373
Hardcoded URL
hf_jobs("uv", {"script": "https://huggingface.co/datasets/uv-scripts/.../raw/main/foo.py"})
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.
High
SKILL.md:376
Hardcoded URL
hf_jobs("uv", {"script": "https://raw.githubusercontent.com/huggingface/trl/main/trl/scripts/sft.py"
The example executes a remote script from a mutable main branch without a commit pin or integrity check. Upstream changes could run arbitrary code inside a credentialed job.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:315-321scripts/cot-self-instruct.py:41-45
Unpinned Container Images Receive Credentials
Examples run mutable latest or implicit-latest container images. One command passes HF_TOKEN into that image, allowing a compromised future image to capture the credential.
The image references are visibly unpinned, and the script example places HF_TOKEN in the same container invocation.
RISK-002 Medium
SKILL.md:41-45SKILL.md:617-640SKILL.md:724-748
Paid Job Submission Has No Confirmation Gate
The skill directs the agent to submit paid jobs before reporting cost details and also supports recurring schedules. It does not require final user approval before creating either workload.
The directive explicitly submits first and reports details afterward, while the documented examples show nonzero costs and recurring jobs.
RISK-003 Medium
scripts/cot-self-instruct.py:547-551scripts/generate-responses.py:527-530scripts/finepdfs-stats.py:345-348
Secrets Accepted Through Command-Line Arguments
All bundled scripts accept Hugging Face tokens as command-line values. Tokens supplied this way can remain in shell history or appear in process listings.
Each parser explicitly defines an hf-token option, a well-known credential exposure channel when users supply the value on a command line.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Mutable remote scripts are executed without integrity controls.
    Pin every remote script to an immutable commit and verify its digest before submission. Prefer the bundled reviewed script content.
  2. FIX-002
    High
    Mutable container images can run while HF_TOKEN is available.
    Pin container images by digest and review the image provenance. Never pass credentials to an unpinned image.
  3. FIX-003
    High
    Token command substitution and command-line options can expose credentials.
    Remove hf-token arguments and shell substitution examples. Use the platform secret option or an authenticated credential store.
  4. FIX-004
    Medium
    Paid and recurring jobs can be created without final user confirmation.
    Show hardware, timeout, destination, schedule, and estimated cost. Require explicit approval immediately before every submission or schedule creation.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Content hash
0541e209f66da587fb0308d596662f6e146eb3e27badf73836f9c363a8f59aa7
Tree hash
cf7d49ef3a70ed90cad79f57aa4ebe7673ac3c136a48fa1aa17610165b4004b1
Skill path
skills/sickn33/hugging-face-jobs
Audit payload hash
00b96b3e016921dd0af2cd05839d2331

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active