hugging-face-jobs
Verdict safe, but 8 findings (5 medium, 3 low), mainly data exfiltration, resource abuse, transitive trust abuse. Most recent scan 2026-02-07.
The hugging-face-jobs skill is a legitimate cloud compute orchestration tool with MEDIUM security posture. The skill correctly implements token security through the '$HF_TOKEN' placeholder mechanism and provides comprehensive documentation about secure practices. However, the extensive documentation of alternative (less secure) token methods and missing optional manifest fields represent areas for improvement. The skill's core functionality—submitting jobs to Hugging Face infrastructure—is appropriate and does not exhibit malicious behavior. The example scripts demonstrate proper security practices including token validation and secure Hub interactions. The primary concern is documentation that may inadvertently encourage insecure token handling, though the skill itself recommends secure methods.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
This skill should be used when users want to run any workload on Hugging Face Jobs infrastructure. Covers UV scripts, Docker-based jobs, hardware selection, cost estimation, authentication with tokens, secrets management, timeout configuration, and result persistence. Designed for general-purpose compute workloads including data processing, inference, experiments, batch jobs, and any Python-based tasks. Should be invoked for tasks involving cloud compute, GPU workloads, or when users mention running jobs on Hugging Face infrastructure without local setup.
- Package
- 9 files, 136 KB
- SKILL.md
- 3831 words, 12+ sections
- Code
- Python (3)
- License
- Complete terms in LICENSE.txt
SKILL.md covers: Running Workloads on Hugging Face Jobs · Overview · When to Use This Skill · Key Directives · Prerequisites Checklist · ✅ **Account & Authentication** · ✅ **Token Usage** (See Token Usage section for details) · Token Usage Guide · Understanding Tokens · When Tokens Are Required · How to Provide Tokens to Jobs · Using Tokens in Scripts
Findings
MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic
Pattern detected: os.environ.get("HF_TOKEN
scripts/generate-responses.py:228
HF_TOKEN = hf_token or os.environ.get("HF_TOKEN") or get_token()MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic
Pattern detected: os.environ.get("HF_TOKEN
scripts/cot-self-instruct.py:572
hf_token = args.hf_token or os.environ.get("HF_TOKEN")MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic
Pattern detected: os.environ.get("HF_TOKEN
scripts/finepdfs-stats.py:470
hf_token = args.hf_token or os.environ.get("HF_TOKEN")MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic
Detects skills that delegate trust to untrusted external content: run script
SKILL.md:1024
| Run Docker job | `hf_jobs("run", {...})` | `hf jobs run image cmd` | `run_job(image, command)` |MEDIUM Hardcoded Token Exposure Risk in Documentation Data Exfiltrationllm
The skill's documentation and referenced files contain multiple examples showing token handling patterns that could lead users to hardcode tokens. While the skill correctly recommends using '$HF_TOKEN' placeholder (automatic token), the extensive documentation about 'Method 2: Explicit Token' and examples of token extraction using 'get_token()' may encourage insecure practices. The references/token_usage.md file shows explicit token usage patterns that are marked 'Not Recommended' but still documented in detail.
Method 2: Explicit Token (Not Recommended) section shows: hf_jobs('uv', {'script': 'your_script.py', 'secrets': {'HF_TOKEN': 'hf_...'} # Hardcoded tokenLOW Missing allowed-tools Declaration Resource Abusellm
The skill manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be used. This is informational only, as the skill legitimately needs broad tool access for job submission and monitoring.
SKILL.md
allowed-tools: Not specifiedLOW Missing compatibility Declaration Resource Abusellm
The skill manifest does not specify the 'compatibility' field. While optional, this field helps users understand which environments (Claude.ai, Claude Code, API) the skill is designed for. This is informational only.
SKILL.md
compatibility: Not specifiedLOW Environment Variable Access Without Validation Data Exfiltrationllm
The example scripts access environment variables (HF_TOKEN, HF_XET_HIGH_PERFORMANCE) without comprehensive validation in some code paths. While assertions are present in many places, some scripts show direct os.environ.get() usage without validation that could lead to silent failures if tokens are missing.
os.environ.get('HF_TOKEN') used without consistent validation across all scriptsWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 30 KB |
index.html | data | 7.5 KB |
references/hardware_guide.md | doc | 8.1 KB |
references/hub_saving.md | doc | 7.5 KB |
references/token_usage.md | doc | 12 KB |
references/troubleshooting.md | doc | 9.6 KB |
scripts/cot-self-instruct.py | script | 24 KB |
scripts/finepdfs-stats.py | script | 17 KB |
scripts/generate-responses.py | script | 20 KB |
External hosts referenced
huggingface.co hf.co your-api.com discuss.huggingface.co docs.astral.sh raw.githubusercontent.com status.huggingface.co
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
HF_TOKEN WEBHOOK_PAYLOAD HF_XET_HIGH_PERFORMANCE
Package contents recorded 2026-10-22 at commit 2afeee6dc727. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/huggingface/skills
- Raw scan result: skills-hugging-face-jobs-scan.json
- Badge for your README:
- Request a re-scan