hugging-face-datasets

ISSUES FOUND max severity CRITICALSkillSpector Do not install 78 registry huggingface last scanned 1 scan

78 findings (27 critical, 47 medium, 4 low), mainly transitive trust abuse, command injection, data exfiltration. Most recent scan 2026-02-07.

This Hugging Face dataset management skill is generally well-designed for its intended purpose of creating and querying datasets on Hugging Face Hub. The skill uses legitimate APIs and follows Python best practices with PEP 723 dependency management. The primary security concerns are operational rather than malicious: missing token validation, lack of resource limits on SQL queries, and incomplete metadata documentation. No evidence of data exfiltration, prompt injection, or malicious behavior was found. The scripts operate transparently with clear documentation and use standard Hugging Face Hub APIs. The skill would benefit from enhanced input validation, resource management, and more complete YAML manifest documentation.

Scanner's overall assessment (LLM analyzer)
Findings78
Critical27
High0
Medium47
Low4
Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 78
Score78 / 100
Issues7
CategoriesData Exfiltration Tool Misuse Privilege Escalation
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Create and manage datasets on Hugging Face Hub. Supports initializing repos, defining configs/system prompts, streaming row updates, and SQL-based dataset querying/transformation. Designed to work alongside HF MCP server for comprehensive dataset workflows.

Package
12 files, 105 KB
SKILL.md
1967 words, 12+ sections
Code
Python (2)

SKILL.md covers: Overview · Integration with HF MCP Server · Version · Dependencies · This skill uses PEP 723 scripts with inline dependency management · Scripts auto-install requirements when run with: uv run scripts/script_name.py · Core Capabilities · 1. Dataset Lifecycle Management · 2. SQL-Based Dataset Querying (NEW) · 3. Multi-Format Dataset Support · 4. Quality Assurance Features · Usage Instructions

Findings

CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed}

scripts/sql_manager.py:262

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed})"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n}

scripts/sql_manager.py:264

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT COUNT(*) FROM '{hf_path}

scripts/sql_manager.py:285

sql = f"SELECT COUNT(*) FROM '{hf_path}'"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f" WHERE {where}

scripts/sql_manager.py:287

sql += f" WHERE {where}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT DISTINCT {column} FROM '{hf_path}' LIMIT {limit}

scripts/sql_manager.py:310

sql = f"SELECT DISTINCT {column} FROM '{hf_path}' LIMIT {limit}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT {select}", f"FROM '{hf_path}

scripts/sql_manager.py:383

sql_parts = [f"SELECT {select}", f"FROM '{hf_path}'"]
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"WHERE {where}

scripts/sql_manager.py:386

sql_parts.append(f"WHERE {where}")
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}

scripts/sql_manager.py:471

processed_sql = f"SELECT * FROM '{hf_path}'"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f" WHERE {args.where}

scripts/sql_manager.py:781

query_sql += f" WHERE {args.where}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed}

sql_manager.py:262

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed})"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n}

sql_manager.py:264

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT COUNT(*) FROM '{hf_path}

sql_manager.py:285

sql = f"SELECT COUNT(*) FROM '{hf_path}'"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f" WHERE {where}

sql_manager.py:287

sql += f" WHERE {where}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT DISTINCT {column} FROM '{hf_path}' LIMIT {limit}

sql_manager.py:310

sql = f"SELECT DISTINCT {column} FROM '{hf_path}' LIMIT {limit}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT {select}", f"FROM '{hf_path}

sql_manager.py:383

sql_parts = [f"SELECT {select}", f"FROM '{hf_path}'"]
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"WHERE {where}

sql_manager.py:386

sql_parts.append(f"WHERE {where}")
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}

sql_manager.py:471

processed_sql = f"SELECT * FROM '{hf_path}'"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f" WHERE {args.where}

sql_manager.py:781

query_sql += f" WHERE {args.where}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed}

scripts/sql_manager.py:262

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n} (RESERVOIR, {seed})"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}' USING SAMPLE {n}

scripts/sql_manager.py:264

sql = f"SELECT * FROM '{hf_path}' USING SAMPLE {n}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT COUNT(*) FROM '{hf_path}

scripts/sql_manager.py:285

sql = f"SELECT COUNT(*) FROM '{hf_path}'"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f" WHERE {where}

scripts/sql_manager.py:287

sql += f" WHERE {where}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT DISTINCT {column} FROM '{hf_path}' LIMIT {limit}

scripts/sql_manager.py:310

sql = f"SELECT DISTINCT {column} FROM '{hf_path}' LIMIT {limit}"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT {select}", f"FROM '{hf_path}

scripts/sql_manager.py:383

sql_parts = [f"SELECT {select}", f"FROM '{hf_path}'"]
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"WHERE {where}

scripts/sql_manager.py:386

sql_parts.append(f"WHERE {where}")
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f"SELECT * FROM '{hf_path}

scripts/sql_manager.py:471

processed_sql = f"SELECT * FROM '{hf_path}'"
Remediation: Use parameterized queries with ? or %s placeholders
CRITICAL SQL query with string formatting (SQL injection risk) Command Injectionstatic

Pattern detected: f" WHERE {args.where}

scripts/sql_manager.py:781

query_sql += f" WHERE {args.where}"
Remediation: Use parameterized queries with ? or %s placeholders
MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.environ.get("HF_TOKEN

scripts/sql_manager.py:51

HF_TOKEN = os.environ.get("HF_TOKEN")
Remediation: Minimize access to environment variables. Document why needed
MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.environ.get("HF_TOKEN

scripts/dataset_manager.py:35

HF_TOKEN = os.environ.get("HF_TOKEN")
Remediation: Minimize access to environment variables. Document why needed
MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.environ.get("HF_TOKEN

sql_manager.py:51

HF_TOKEN = os.environ.get("HF_TOKEN")
Remediation: Minimize access to environment variables. Document why needed
MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.environ.get("HF_TOKEN

scripts/dataset_manager.py:35

HF_TOKEN = os.environ.get("HF_TOKEN")
Remediation: Minimize access to environment variables. Document why needed
MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.environ.get("HF_TOKEN

scripts/sql_manager.py:51

HF_TOKEN = os.environ.get("HF_TOKEN")
Remediation: Minimize access to environment variables. Document why needed
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:13

# Scripts auto-install requirements when run with: uv run scripts/script_name.py
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:54

> Scripts are run with: `uv run scripts/script_name.py [arguments]`
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:73

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:78

uv run scripts/sql_manager.py describe --dataset "cais/mmlu"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:81

uv run scripts/sql_manager.py sample --dataset "cais/mmlu" --n 5
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:84

uv run scripts/sql_manager.py count --dataset "cais/mmlu" --where "subject='nutrition'"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:116

uv run scripts/sql_manager.py describe --dataset "cais/mmlu"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:119

uv run scripts/sql_manager.py unique --dataset "cais/mmlu" --column "subject"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:122

uv run scripts/sql_manager.py histogram --dataset "cais/mmlu" --column "subject" --bins 20
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:128

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:133

uv run scripts/sql_manager.py transform \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:144

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:151

uv run scripts/sql_manager.py transform \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:162

uv run scripts/sql_manager.py export \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:169

uv run scripts/sql_manager.py export \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:179

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:185

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:191

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:200

uv run scripts/sql_manager.py raw --sql "
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:309

uv run scripts/dataset_manager.py init --repo_id "your-username/dataset-name" [--private]
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:312

uv run scripts/dataset_manager.py config --repo_id "your-username/dataset-name" --system_prompt "$(cat system_prompt.txt)"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:318

uv run scripts/dataset_manager.py quick_setup \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:323

uv run scripts/dataset_manager.py add_rows \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:425

uv run scripts/dataset_manager.py add_rows --repo_id "your-username/dataset-name" \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:429

uv run scripts/dataset_manager.py add_rows --repo_id "your-username/dataset-name" \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:433

uv run scripts/dataset_manager.py add_rows --repo_id "your-username/dataset-name" \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:441

uv run scripts/dataset_manager.py list_templates
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:446

uv run scripts/dataset_manager.py quick_setup --repo_id "your-username/dataset-name" --template classification
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:452

uv run scripts/dataset_manager.py init --repo_id "your-username/dataset-name" [--private]
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:455

uv run scripts/dataset_manager.py config --repo_id "your-username/dataset-name" --system_prompt "Your prompt here"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:458

uv run scripts/dataset_manager.py add_rows \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:466

uv run scripts/dataset_manager.py stats --repo_id "your-username/dataset-name"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:482

uv run scripts/sql_manager.py describe --dataset "cais/mmlu"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:483

uv run scripts/sql_manager.py histogram --dataset "cais/mmlu" --column "subject"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:486

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:496

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:505

uv run scripts/sql_manager.py export \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:514

uv run scripts/sql_manager.py query \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:523

uv run scripts/sql_manager.py export \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:532

uv run scripts/dataset_manager.py init --repo_id "username/nutrition-training"
Remediation: Review and remove transitive trust abuse pattern
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic

Detects skills that delegate trust to untrusted external content: run scripts

SKILL.md:533

uv run scripts/dataset_manager.py add_rows \
Remediation: Review and remove transitive trust abuse pattern
MEDIUM Hardcoded HF_TOKEN Environment Variable Dependency Data Exfiltrationllm

Both scripts rely on the HF_TOKEN environment variable for authentication with Hugging Face Hub. While environment variables are a common practice, the scripts do not validate token presence before operations that require authentication, potentially leading to unclear error messages or failed operations. Additionally, there is no guidance on secure token management or rotation.

scripts/dataset_manager.py

HF_TOKEN = os.environ.get("HF_TOKEN") - Token retrieved but not validated before use in API operations
Remediation: Add explicit token validation at script startup with clear error messages. Include documentation on secure token storage practices (e.g., using secret management tools). Implement token validation: if not HF_TOKEN: raise ValueError('HF_TOKEN environment variable must be set')
LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)
LOW Missing Optional Metadata Fields Data Exfiltrationllm

The YAML manifest is missing optional fields that would improve security transparency: 'license' is not specified (though scripts create MIT-licensed datasets), 'compatibility' is not specified, and 'allowed-tools' is not declared. While these are optional fields, their absence reduces visibility into the skill's intended operational boundaries.

SKILL.md

YAML Manifest shows: license: Not specified, compatibility: Not specified, allowed-tools: Not specified
Remediation: Add complete YAML frontmatter with: license: MIT, compatibility: 'Requires uv package manager and HF_TOKEN environment variable', allowed-tools: [Python, Read, Write] to clearly document the skill's requirements and tool usage
LOW Potential Resource Exhaustion in SQL Query Operations Resource Abusellm

The sql_manager.py script allows arbitrary SQL queries on Hugging Face datasets without explicit resource limits, timeouts, or query complexity validation. Large datasets or complex queries (e.g., cross joins, unbounded aggregations) could consume excessive memory or CPU resources.

scripts/sql_manager.py

def query(self, dataset: str, sql: str, ...) - No query timeout, memory limits, or complexity checks implemented
Remediation: Implement query safeguards: 1) Add DuckDB memory_limit and threads configuration, 2) Set query timeout limits, 3) Add warnings for potentially expensive operations (e.g., SELECT * without LIMIT), 4) Document resource considerations in SKILL.md
LOW Unrestricted Dataset Push Capabilities Data Exfiltrationllm

The sql_manager.py script's query_and_push() method allows pushing query results to any Hugging Face repository without validation of the target repository ownership or existence checks. While this requires a valid HF_TOKEN, there's no confirmation prompt or safety check before pushing potentially large datasets.

scripts/sql_manager.py

def query_and_push(...) - Directly pushes to target_repo without ownership validation or confirmation prompts
Remediation: Add safety checks: 1) Verify user owns target repository or has write access, 2) Implement --confirm flag for push operations, 3) Add dry-run mode to preview operations, 4) Validate target repository format and existence

What is in the package

FileKindSize
SKILL.mddoc16 KB
examples/diverse_training_examples.jsonconfig17 KB
examples/system_prompt_template.txtdoc5.3 KB
examples/training_examples.jsonconfig6.7 KB
scripts/dataset_manager.pyscript18 KB
scripts/sql_manager.pyscript28 KB
templates/chat.jsonconfig2.2 KB
templates/classification.jsonconfig1.9 KB
templates/completion.jsonconfig2.6 KB
templates/custom.jsonconfig2.4 KB
templates/qa.jsonconfig2.6 KB
templates/tabular.jsonconfig2.5 KB

External hosts referenced

huggingface.co

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

HF_TOKEN

Package contents recorded 2026-10-22 at commit 2afeee6dc727. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills