huggingface security scan results

9 skills from huggingface scanned, 2 with at least one finding, as of 2026-10-22. Source: https://github.com/huggingface/skills.

9Skills
2With Issues
267Findings
32Critical
0High
213Medium
22Low

Findings by category

Transitive Trust Abuse
147
Data Exfiltration
58
Command Injection
37
Unauthorized Tool Use
10
Policy Violation
5
Resource Abuse
5
Social Engineering
5

Highest-risk skills

  1. hugging-face-datasets ISSUES FOUND 78 findings
  2. hugging-face-tool-builder ISSUES FOUND 12 findings
  3. hugging-face-evaluation SAFE 96 findings
  4. hugging-face-paper-publisher SAFE 54 findings
  5. hugging-face-model-trainer SAFE 14 findings
  6. hugging-face-jobs SAFE 8 findings
  7. hugging-face-cli SAFE 5 findings
  8. hf-mcp SAFE 0 findings
  9. hugging-face-trackio SAFE 0 findings

All huggingface skills

Name Verdict SkillSpector Findings Critical High Medium Low
hugging-face-datasets ISSUES FOUND Do not install 78 78 27 0 47 4
hugging-face-tool-builder ISSUES FOUND Do not install 65 12 5 0 5 2
hugging-face-evaluation SAFE Do not install 100 96 0 0 92 4
hugging-face-paper-publisher SAFE Caution 50 54 0 0 50 4
hugging-face-model-trainer SAFE Do not install 100 14 0 0 14 0
hugging-face-jobs SAFE Do not install 67 8 0 0 5 3
hugging-face-cli SAFE Do not install 100 5 0 0 0 5
hf-mcp SAFE Caution 8 0 0 0 0 0
hugging-face-trackio SAFE Safe 0 0 0 0 0 0