hugging-face-tool-builder

ISSUES FOUND max severity CRITICALSkillSpector Do not install 65 registry huggingface last scanned 2026-02-08 1 scan

12 findings (5 critical, 5 medium, 2 low), mainly command injection, data exfiltration, policy violation. Most recent scan 2026-02-08.

The hugging-face-tool-builder skill is SAFE with minor documentation gaps. The skill creates reusable command-line scripts for interacting with the Hugging Face API. All scripts follow secure patterns: they use the HF_TOKEN environment variable for authentication (avoiding hardcoded secrets), include proper help documentation, handle errors gracefully, and perform legitimate API operations. The scripts read from internal reference files within the skill package (normal behavior for self-contained skills) and make authenticated API calls to huggingface.co (the legitimate service). No prompt injection, data exfiltration, command injection, or other security threats were detected. The only issue is missing optional metadata fields in the YAML manifest, which is a minor documentation concern rather than a security risk.
Scanner's overall assessment (LLM analyzer)

Findings12

Critical5

High0

Medium5

Low2

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 65

Score65 / 100

Issues2

CategoriesData Flow MCP Least Privilege

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Use this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. This is especially useful when chaining or combining API calls or the task will be repeated/automated. This Skill creates a reusable script to fetch, enrich or process data.

Package: 8 files, 27 KB
SKILL.md: 651 words, 6 sections
Code: Shell (5), Python (1), TypeScript (1)

SKILL.md covers: Hugging Face API Tool Builder · Script Rules · Sample Scripts · High Level Endpoints · Accessing the API · Using the HF command line tool

Findings

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;31m

references/find_models_by_paper.sh:10

RED='\033[0;31m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;32m

references/find_models_by_paper.sh:11

GREEN='\033[0;32m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[1;33m

references/find_models_by_paper.sh:12

YELLOW='\033[1;33m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0;34m

references/find_models_by_paper.sh:13

BLUE='\033[0;34m'

Remediation: Review and remove injection attack pattern

CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic

Detects embedded scripting payloads (JS, VBScript, etc.) in MCP tool descriptions: \033[0m

references/find_models_by_paper.sh:14

NC='\033[0m' # No Color

Remediation: Review and remove injection attack pattern

MEDIUM HTTP client library imports that enable external communication Data Exfiltrationstatic

Pattern detected: import urllib.request

references/baseline_hf_api.py:13

import urllib.request

Remediation: Ensure network access is necessary and documented. Review all URLs

MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.getenv("HF_TOKEN

references/baseline_hf_api.py:46

token = os.getenv("HF_TOKEN")

Remediation: Minimize access to environment variables. Document why needed

MEDIUM Undeclared network usage Unauthorized Tool Usestatic

Skill code uses network libraries but doesn't declare network requirement

Remediation: Declare network usage in compatibility field or remove network calls

MEDIUM HTTP client library imports that enable external communication Data Exfiltrationstatic

Pattern detected: import urllib.request

references/baseline_hf_api.py:13

import urllib.request

Remediation: Ensure network access is necessary and documented. Review all URLs

MEDIUM Reading environment variables that may contain secrets Data Exfiltrationstatic

Pattern detected: os.getenv("HF_TOKEN

references/baseline_hf_api.py:46

token = os.getenv("HF_TOKEN")

Remediation: Minimize access to environment variables. Document why needed

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Missing Optional Metadata Fields Social Engineeringllm

The skill's YAML manifest is missing optional metadata fields (license, compatibility, allowed-tools). While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and constraints. The missing 'allowed-tools' field means users cannot verify which agent tools the skill intends to use.

SKILL.md

license: Not specified
compatibility: Not specified
allowed-tools: Not specified

Remediation: Add optional metadata fields to improve transparency: - license: Specify the license (e.g., MIT, Apache-2.0) - compatibility: Document where the skill works (e.g., 'Claude.ai, Claude Code, API') - allowed-tools: Declare which tools are used (e.g., [Bash, Python, Read, Write])

What is in the package

File	Kind	Size
`SKILL.md`	doc	5.2 KB
`references/baseline_hf_api.py`	script	1.3 KB
`references/baseline_hf_api.sh`	script	707 B
`references/baseline_hf_api.tsx`	script	1.2 KB
`references/find_models_by_paper.sh`	script	7.5 KB
`references/hf_enrich_models.sh`	script	2.2 KB
`references/hf_model_card_frontmatter.sh`	script	4.4 KB
`references/hf_model_papers_auth.sh`	script	4.7 KB

External hosts referenced

huggingface.co

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

HF_TOKEN API_URL MODELS_WITH_PAPERS AUTH_HEADER MODELS_WITH_PAPERS_COUNT MODEL_ID README_PATH TOTAL_MODELS USE_TOKEN

Package contents recorded 2026-10-22 at commit 2afeee6dc727. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/huggingface/skills
Raw scan result: skills-hugging-face-tool-builder-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/huggingface-hugging-face-tool-builder.svg)
Request a re-scan