Security report · 6h ago
huggingface/skills
Chf-cloud-aws-context-discovery
skills/hf-cloud-aws-context-discovery68/100 · Review before installing3 high2 low
hf-cloud-aws-context-discovery
skills/hf-cloud-aws-context-discoveryDiscover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.
- Content hash
- sha256:aa7b422046bc2b76cfd8ca888767d45e46d5c3657c86589947d52c8cb631dd0f
- Files
- 1
- Quality
- 100/100
Security findings
- highReads credential filesSL201 · skills/hf-cloud-aws-context-discovery/SKILL.md:16
`AWS_PROFILE` env var, else `default`. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in `~/.aws/config`, …The skill references files that hold private keys or cloud credentials. Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.
- highReads credential filesSL201 · skills/hf-cloud-aws-context-discovery/SKILL.md:24
4. `region` field on the active profile in `~/.aws/config`The skill references files that hold private keys or cloud credentials. Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.
- highReads credential filesSL201 · skills/hf-cloud-aws-context-discovery/SKILL.md:64
`aws configure list` handles env-var overrides and shows the resolved effective values. Prefer it over parsing `~/.aws/config` yourself. If you need to read ra…The skill references files that hold private keys or cloud credentials. Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.
- lowHides actions from the userSL102 · skills/hf-cloud-aws-context-discovery/SKILL.md:8
Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers.The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.
- lowHides actions from the userSL102 · skills/hf-cloud-aws-context-discovery/SKILL.md:72
Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md3.9 KB
Chf-cli
skills/hf-cli74/100 · Review before installing1 high
hf-cli
skills/hf-cliHugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`.
- Content hash
- sha256:f2e6dba382dccfb4975ade236affcf9a009abdc60a91191609a00595730f66eb
- Files
- 1
- Quality
- 100/100
Security findings
- highPipes a download into a shellSL301 · skills/hf-cli/SKILL.md:6
Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`.Remote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine. Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill.
Files in this skill
- SKILL.md33.2 KB
Ahuggingface-trackio
skills/huggingface-trackio92/100 · No meaningful risk found2 medium
huggingface-trackio
skills/huggingface-trackioTrack and visualize ML training experiments with Trackio. Use when logging metrics during training (Python API), firing alerts for training diagnostics, or retrieving/analyzing logged metrics (CLI). Supports real-time dashboard visualization, alerts with webhooks, HF Space syncing, and JSON output for automation.
- Content hash
- sha256:e064ddc0cca411aafb45189dad25083dcd1179bc4df4ec988f197b9e8b424a6d
- Files
- 4
- Quality
- 100/100
Security findings
- mediumKnown exfiltration endpointSL204 · skills/huggingface-trackio/references/alerts.md:35
webhook_url="https://hooks.slack.com/services/...",The skill talks to a service commonly used to receive stolen data. Fix: Remove the endpoint, or replace it with a documented API the user owns. Severity lowered: the line reads as documentation, not an instruction.
- mediumKnown exfiltration endpointSL204 · skills/huggingface-trackio/references/alerts.md:46
webhook_url="https://hooks.slack.com/services/...", # Overrides global URLThe skill talks to a service commonly used to receive stolen data. Fix: Remove the endpoint, or replace it with a documented API the user owns. Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · skills/huggingface-trackio/references/logging_metrics.md:11
pip install trackioInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · skills/huggingface-trackio/references/logging_metrics.md:13
uv pip install trackioInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md5.0 KB
- references/alerts.md5.8 KB
- references/logging_metrics.md5.4 KB
- references/retrieving_metrics.md8.5 KB
Ahuggingface-community-evals
skills/huggingface-community-evals94/100 · No meaningful risk found1 medium
huggingface-community-evals
skills/huggingface-community-evalsRun evaluations for Hugging Face Hub models using inspect-ai and lighteval on local hardware. Use for backend selection, local GPU evals, and choosing between vLLM / Transformers / accelerate. Not for HF Jobs orchestration, model-card PRs, .eval_results publication, or community-evals automation.
- Content hash
- sha256:363ca54bbc69986df1634b288b790725b86988c7d45259bb723cef9fe6e05239
- Files
- 6
- Quality
- 100/100
Security findings
- mediumDumps environment variablesSL202 · skills/huggingface-community-evals/SKILL.md:47
printenv HF_TOKEN >/dev/nullThe skill collects every environment variable, which usually includes API keys and tokens. Fix: Read only the specific variable you need, by name.
Files in this skill
- SKILL.md6.4 KB
- examples/.env.example159 B
- examples/USAGE_EXAMPLES.md2.0 KB
- scripts/inspect_eval_uv.py2.9 KB
- scripts/inspect_vllm_uv.py8.9 KB
- scripts/lighteval_vllm_uv.py9.0 KB
Ahuggingface-spaces
skills/huggingface-spaces94/100 · No meaningful risk found5 low
huggingface-spaces
skills/huggingface-spacesBuild, deploy, and maintain applications on Hugging Face Spaces — Gradio / Docker / Static SDKs, ZeroGPU and dedicated hardware, model loading, debugging, buckets, inference providers, community grants. Use whenever the user asks to create or host an app on Hugging Face, port code onto ZeroGPU, fix a Space that won't build or run, or otherwise work with `hf spaces …`, `@spaces.GPU`, Space README frontmatter, or the `spaces` Python package.
- Content hash
- sha256:76e63ff9317995dbd0d81493159b42252218b09318121c49c34f90ddbc1964df
- Files
- 15
- Quality
- 100/100
Security findings
- lowInstalls code straight from a URLSL502 · skills/huggingface-spaces/references/3d-models.md:126
shlex.split("pip install --no-build-isolation git+https://github.com/tatsy/torchmcubes.git"),The dependency is fetched from a mutable URL or branch. Fix: Pin to a commit SHA or a published version with a checksum. Severity lowered: the line reads as documentation, not an instruction.
- lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/debugging.md:110
r = httpx.post(f"https://<subdomain>.hf.space/your_route",The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
- lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/debugging.md:181
curl -s -X POST \The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
- lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/debugging.md:223
curl -s -X POST -H "Authorization: Bearer $HF_TOKEN" \The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
- lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/known-errors.md:217
**Fix**: For streaming, use `client.submit(...).result()` (or iterate the job). For custom routes, use `httpx.post(base_url + "/route", ...)` directly — bypass…The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
- infoInstalls code straight from a URLSL502 · skills/huggingface-spaces/references/3d-gsplat.md:23
**Shape B — a real rasterizer (only for server-rendered orbit videos).** If the code uses the upstream Inria API, take the prebuilt wheel from `requirements.md…The dependency is fetched from a mutable URL or branch. Fix: Pin to a commit SHA or a published version with a checksum. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- README.md412 B
- SKILL.md17.5 KB
- references/3d-cuda-extensions.md9.1 KB
- references/3d-generation.md8.6 KB
- references/3d-gsplat.md7.2 KB
- references/3d-models.md19.6 KB
- references/3d-outputs.md9.3 KB
- references/buckets.md4.3 KB
- references/debugging.md11.3 KB
- references/gradio.md9.2 KB
- references/grants.md3.1 KB
- references/inference-providers.md3.8 KB
- references/known-errors.md13.3 KB
- references/requirements.md11.3 KB
- references/zerogpu.md20.9 KB
Atrain-sentence-transformers
skills/train-sentence-transformers94/100 · No meaningful risk found1 medium
train-sentence-transformers
skills/train-sentence-transformersTrain or fine-tune sentence-transformers models across `SentenceTransformer` (bi-encoder, dense or static embedding model for retrieval, similarity, clustering, classification, paraphrase mining, dedup, multimodal), `CrossEncoder` (reranker, pair scoring for two-stage retrieval / pair classification), `SparseEncoder` (SPLADE, sparse embedding model for learned-sparse retrieval), and `MultiVectorEncoder` (ColBERT / late-interaction, per-token embeddings scored with MaxSim). Covers loss selection, hard-negative mining, evaluators, distillation, LoRA, Matryoshka, and Hugging Face Hub publishing. Use for any sentence-transformers training task.
- Content hash
- sha256:07598caaed95b6c6e971fa05e5aba2d8adc1677bea2d9015c0c10ade2bf59eb8
- Files
- 31
- Quality
- 100/100
Security findings
- mediumPipes a download into a shellSL301 · skills/train-sentence-transformers/references/hf_jobs_execution.md:9
- Access to the `hf_jobs()` MCP tool, or the `hf` CLI (`curl -LsSf https://hf.co/cli/install.sh | bash -s`).Remote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine. Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md10.3 KB
- references/base_model_selection.md7.5 KB
- references/dataset_formats.md6.3 KB
- references/evaluators_cross_encoder.md5.5 KB
- references/evaluators_multi_vector_encoder.md6.6 KB
- references/evaluators_sentence_transformer.md5.8 KB
- references/evaluators_sparse_encoder.md4.9 KB
- references/hardware_guide.md5.9 KB
- references/hf_jobs_execution.md7.1 KB
- references/losses_cross_encoder.md9.5 KB
- references/losses_multi_vector_encoder.md10.5 KB
- references/losses_sentence_transformer.md10.7 KB
- references/losses_sparse_encoder.md5.1 KB
- references/model_architectures.md9.0 KB
- references/prompts_and_instructions.md6.4 KB
- references/training_args.md15.0 KB
- references/troubleshooting.md12.9 KB
- scripts/mine_hard_negatives.py8.3 KB
- scripts/train_cross_encoder_distillation_example.py9.2 KB
- scripts/train_cross_encoder_example.py9.0 KB
- scripts/train_cross_encoder_listwise_example.py10.2 KB
- scripts/train_multi_vector_encoder_example.py8.8 KB
- scripts/train_sentence_transformer_distillation_example.py11.9 KB
- scripts/train_sentence_transformer_example.py7.5 KB
- scripts/train_sentence_transformer_make_multilingual_example.py11.5 KB
- scripts/train_sentence_transformer_matryoshka_example.py7.1 KB
- scripts/train_sentence_transformer_multi_dataset_example.py9.9 KB
- scripts/train_sentence_transformer_static_embedding_example.py10.3 KB
- scripts/train_sentence_transformer_with_lora_example.py10.3 KB
- scripts/train_sparse_encoder_distillation_example.py9.4 KB
- scripts/train_sparse_encoder_example.py8.1 KB
Ahuggingface-llm-trainer
skills/huggingface-llm-trainer96/100 · No meaningful risk found6 low
huggingface-llm-trainer
skills/huggingface-llm-trainerTrain or fine-tune language and vision models using TRL (Transformer Reinforcement Learning) or Unsloth with Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward modeling training methods, plus GGUF conversion for local deployment. Includes guidance on the TRL Jobs package, UV scripts with PEP 723 format, dataset preparation and validation, hardware selection, cost estimation, Trackio monitoring, Hub authentication, model selection/leaderboards and model persistence. Use for tasks involving cloud GPU training, GGUF conversion, or when users mention training on Hugging Face Jobs without local GPU setup.
- Content hash
- sha256:a3d33f07e5180e179ee79aed996a0c19c68bdac123fbcb69c34f2685dc48ceae
- Files
- 19
- Quality
- 100/100
Security findings
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:27
- Ubuntu/Debian: sudo apt-get update && sudo apt-get install -y build-essential cmakeThe skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:28
- RHEL/CentOS: sudo yum groupinstall -y "Development Tools" && sudo yum install -y cmakeThe skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:57
print(" Ubuntu/Debian: sudo apt-get install git")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:58
print(" RHEL/CentOS: sudo yum install git")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:68
print(" Ubuntu/Debian: sudo apt-get install build-essential cmake")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:69
print(" RHEL/CentOS: sudo yum groupinstall 'Development Tools' && sudo yum install cmake")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
Quality
- infoSKILL.md is longSL705 · skills/huggingface-llm-trainer/SKILL.md:1
739 linesLong skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.
Files in this skill
- SKILL.md28.1 KB
- references/gguf_conversion.md9.6 KB
- references/hardware_guide.md6.6 KB
- references/hub_saving.md8.3 KB
- references/local_training_macos.md8.1 KB
- references/reliability_principles.md10.6 KB
- references/trackio_guide.md6.3 KB
- references/training_methods.md4.9 KB
- references/training_patterns.md6.0 KB
- references/troubleshooting.md8.7 KB
- references/unsloth.md7.8 KB
- scripts/convert_to_gguf.py12.3 KB
- scripts/dataset_inspector.py15.3 KB
- scripts/estimate_cost.py4.7 KB
- scripts/hf_benchmarks.py19.6 KB
- scripts/train_dpo_example.py3.0 KB
- scripts/train_grpo_example.py2.3 KB
- scripts/train_sft_example.py3.3 KB
- scripts/unsloth_sft_example.py16.5 KB
Ahf-cloud-sagemaker-deployment-planner
skills/hf-cloud-sagemaker-deployment-planner98/100 · No meaningful risk found1 low
hf-cloud-sagemaker-deployment-planner
skills/hf-cloud-sagemaker-deployment-plannerPlan and coordinate the deployment of a model to Amazon SageMaker AI. Use this skill whenever the user wants to deploy, host, serve, or expose a model on SageMaker or AWS — including phrases like "deploy a model", "host this LLM on AWS", "serve this embedding model", "deploy a reranker", "deploy a text-to-image / diffusion model", "host this for async inference", "create an endpoint", "serve my fine-tuned model", or any request that involves making a model available for inference on AWS. Use this even when the user is vague (e.g. "I just want to get this running on AWS, you figure it out"). Works for text-generation LLMs, embedding models, rerankers, classifiers, text-to-image / diffusion models — picks the right serving stack and chooses between real-time and async inference. This is the entry-point skill for SageMaker deployment work — it asks clarifying questions, picks a deployment pathway, and coordinates the other deployment skills.
- Content hash
- sha256:153150455ceef0e532512b4b53e00525c5d85390567f6e3f29e5e8e73b974c35
- Files
- 1
- Quality
- 100/100
Security findings
- lowHides actions from the userSL102 · skills/hf-cloud-sagemaker-deployment-planner/SKILL.md:70
If the call itself is denied, say so once and continue. The quota check is an optimization, not a gate: the deployment surfaces the real limit as `ResourceLimi…The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md8.4 KB
Ahuggingface-datasets
skills/huggingface-datasets98/100 · No meaningful risk found2 low
huggingface-datasets
skills/huggingface-datasetsUse this skill for Hugging Face Dataset Viewer API workflows that fetch subset/split metadata, paginate rows, search text, apply filters, download parquet URLs, and read size or statistics.
- Content hash
- sha256:2502296e92ca38813dd7f73bf33f53bd27d7ca629487b4afeeb7c58bedef0619
- Files
- 1
- Quality
- 100/100
Security findings
- lowUnpinned package installSL501 · skills/huggingface-datasets/SKILL.md:83
npx -y @huggingface/hub upload datasets/<namespace>/<repo> ./local/parquet-folder dataInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).
- lowUnpinned package installSL501 · skills/huggingface-datasets/SKILL.md:89
npx -y @huggingface/hub upload datasets/<namespace>/<repo> ./local/parquet-folder data --privateInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).
Files in this skill
- SKILL.md4.6 KB
Ahuggingface-zerogpu
skills/huggingface-zerogpu98/100 · No meaningful risk found1 low
huggingface-zerogpu
skills/huggingface-zerogpuAI demos and GPU compute with Gradio Spaces and Hugging Face Spaces ZeroGPU. Use when writing or reviewing code that uses `@spaces.GPU`, configuring `python_version` or `requirements.txt` for a ZeroGPU Space, or handling ZeroGPU-specific code constraints — pickle-based process isolation, `gr.State` semantics across the worker boundary, no `torch.compile` (use AoTI instead), CUDA wheel-only builds (no `nvcc` at build or runtime), large vs xlarge sizing, and dynamic duration callables. Make sure to use this skill whenever the user mentions ZeroGPU, `@spaces.GPU`, or the `spaces` Python package, or hits ZeroGPU-specific code errors like `PicklingError` across the worker boundary, `illegal duration`, or `flash-attn` wheel-build failures — even when the user does not explicitly ask for ZeroGPU coding guidance. Trigger on `import spaces` or `@spaces.GPU` in code.
- Content hash
- sha256:e4519bc1a792b58f201625139270c67c9e844d667d00020954b2f975864bd34e
- Files
- 5
- Quality
- 100/100
Security findings
- lowHides actions from the userSL102 · skills/huggingface-zerogpu/SKILL.md:81
Do not run inference or CUDA kernels at module scope — the real GPU is not attached, so operations either silently run on CPU or fail.The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md17.8 KB
- references/concurrency.md2.5 KB
- references/cuda-and-deps.md4.7 KB
- references/how-quota-works.md3.8 KB
- references/how-zerogpu-works.md4.7 KB
Atransformers-js
skills/transformers-js98/100 · No meaningful risk found2 low
transformers-js
skills/transformers-jsUse Transformers.js to run state-of-the-art machine learning models directly in JavaScript/TypeScript. Supports NLP (text classification, translation, summarization), computer vision (image classification, object detection), audio (speech recognition, audio classification), and multimodal tasks. Works in browsers and server-side runtimes (Node.js, Bun, Deno) with WebGPU/WASM using pre-trained models from Hugging Face Hub.
- Content hash
- sha256:2f2c4c9382a143cc30894152981b44affce69ad140cb057d4f5e9df06d9860c3
- Files
- 8
- Quality
- 100/100
Security findings
- lowUnpinned package installSL501 · skills/transformers-js/SKILL.md:30
npm install @huggingface/transformersInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).
- lowUnpinned package installSL501 · skills/transformers-js/SKILL.md:457
npm install @huggingface/tokenizersInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).
Quality
- infoSKILL.md is longSL705 · skills/transformers-js/SKILL.md:1
693 linesLong skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.
Files in this skill
- SKILL.md24.3 KB
- references/CACHE.md9.0 KB
- references/CONFIGURATION.md10.8 KB
- references/EXAMPLES.md15.3 KB
- references/MODEL_ARCHITECTURES.md5.5 KB
- references/MODEL_REGISTRY.md5.9 KB
- references/PIPELINE_OPTIONS.md14.6 KB
- references/TEXT_GENERATION.md7.7 KB
Ahf-mcp
hf-mcp/skills/hf-mcp100/100 · No meaningful risk foundNo security findings
hf-mcp
hf-mcp/skills/hf-mcpUse Hugging Face Hub via MCP server tools. Search models, datasets, Spaces, papers. Get repo details, fetch documentation, run compute jobs, and use Gradio Spaces as AI tools. Available when connected to the HF MCP server.
- Content hash
- sha256:8905cafa9d5263941be0454ef2ddbffc260a2a2de5f9ceef8fb1a38f1808354c
- Files
- 1
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md4.9 KB
Ahf-cloud-python-env-setup
skills/hf-cloud-python-env-setup100/100 · No meaningful risk foundNo security findings
hf-cloud-python-env-setup
skills/hf-cloud-python-env-setupSet up an isolated Python environment for SageMaker / AWS work, with the right Python version and current boto3. Use this skill whenever Python code will be executed for a SageMaker deployment, training job, or any AWS automation — including when about to run `pip install`, when about to invoke `boto3`, when creating or activating a virtualenv, or when the user asks to "set up the environment". Never use system Python and never `pip install` into it. Always isolate. This skill prevents the most common failure modes: wrong Python version, dependency conflicts, and stale SDKs.
- Content hash
- sha256:85e3fcd0bd164e3fb385f066b75a96f202acde7fcb2ef7def1332bad1058cec0
- Files
- 4
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md6.6 KB
- requirements.txt796 B
- scripts/check_versions.py740 B
- scripts/setup_env.py4.9 KB
Ahf-cloud-sagemaker-iam-preflight
skills/hf-cloud-sagemaker-iam-preflight100/100 · No meaningful risk foundNo security findings
hf-cloud-sagemaker-iam-preflight
skills/hf-cloud-sagemaker-iam-preflightEnsure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.
- Content hash
- sha256:0c45a20c9fa142609926d17521810b04ddf83f9a448c502e9bf0ea1fcf4b3e6d
- Files
- 5
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md6.9 KB
- references/minimum-permissions.json1.0 KB
- references/trust-policy.json197 B
- scripts/check_role.py6.7 KB
- scripts/create_role.py3.8 KB
Ahf-cloud-sagemaker-production-defaults
skills/hf-cloud-sagemaker-production-defaults100/100 · No meaningful risk foundNo security findings
hf-cloud-sagemaker-production-defaults
skills/hf-cloud-sagemaker-production-defaultsCreate a SageMaker endpoint (real-time, real-time scale-to-zero, or async) with autoscaling, CloudWatch alarms, and tagging enabled by default. Use this skill whenever about to create a SageMaker endpoint, write deployment code that calls `create_endpoint`, or finalize a deployment after the image URI and IAM role are known. Provides deploy.py for real-time endpoints, deploy_ic.py for real-time endpoints that scale to zero instances via inference components, and deploy_async.py for async endpoints (also scale-to-zero). This is the last step in the SageMaker deployment workflow. Never generate a bare `create_endpoint` call without these defaults — endpoints without autoscaling or alarms are demos, not deployments.
- Content hash
- sha256:a1a69b18bf7178dab3fd3d128d477287ed014d7f9ae71f0df862145ce05832c4
- Files
- 8
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md27.0 KB
- references/deployment-template.md3.6 KB
- scripts/_common.py4.8 KB
- scripts/deploy.py12.7 KB
- scripts/deploy_async.py18.1 KB
- scripts/deploy_ic.py20.2 KB
- scripts/invoke_endpoint.py6.4 KB
- scripts/teardown.py9.2 KB
Ahf-cloud-serving-image-selection
skills/hf-cloud-serving-image-selection100/100 · No meaningful risk foundNo security findings
hf-cloud-serving-image-selection
skills/hf-cloud-serving-image-selectionPick the right serving container for a SageMaker model deployment and find its current image URI. Use this skill whenever about to deploy a model to a SageMaker endpoint and an image URI needs to be chosen — including when the user says "deploy this LLM", "host this HuggingFace model", "serve this fine-tuned model", "deploy this embedding model", "host a reranker", "serve a sentence-transformers model", or when about to hardcode any container URI in deployment code. HuggingFace-curated Deep Learning Containers are ALWAYS preferred: HuggingFace vLLM (LLMs and generative rerankers), HuggingFace vLLM-Omni (multimodal), TEI (embeddings/cross-encoder rerankers), HF Inference Toolkit (other transformers). Generic images (AWS vLLM, DJL-LMI, SGLang) are used only when no HuggingFace image is compatible — never merely because they carry a newer version. Never hardcode a container URI from memory and never default to TGI. Prevents stale-image failures and wrong-region URIs.
- Content hash
- sha256:a284c45d651d3d0c4745ce815fcf5a9851f223b19ff667bf65a564811677434e
- Files
- 3
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md18.1 KB
- references/model-to-image.md10.6 KB
- scripts/mirror_image.py4.7 KB
Ahf-mem
skills/hf-mem100/100 · No meaningful risk foundNo security findings
hf-mem
skills/hf-memHugging Face CLI to estimate the required memory to load Safetensors or GGUF model weights for inference from the Hugging Face Hub
- Content hash
- sha256:21fc28bcb9369e6924a708fd6db366dc9416a985417f64df9e314c866fae8d09
- Files
- 1
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md3.2 KB
Ahuggingface-best
skills/huggingface-best100/100 · No meaningful risk foundNo security findings
huggingface-best
skills/huggingface-bestUse when the user asks about finding the best, top, or recommended model for a task, wants to know what AI model to use, or wants to compare models by benchmark scores. Triggers on: "best model for X", "what model should I use for", "top models for [task]", "which model runs on my laptop/machine/device", "recommend a model for", "what LLM should I use for", "compare models for", "what's state of the art for", or any question about choosing an AI model for a specific use case. Always use this skill when the user wants model recommendations or comparisons, even if they don't explicitly mention HuggingFace or benchmarks.
- Content hash
- sha256:fc492781c6b3a28458dcff23f6537f7a8c2d2ce64517e80d4616ae375ab734f5
- Files
- 1
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md5.7 KB
Ahuggingface-gradio
skills/huggingface-gradio100/100 · No meaningful risk foundNo security findings
huggingface-gradio
skills/huggingface-gradioBuild Gradio web UIs and demos in Python. Use when creating or editing Gradio apps, components, event listeners, layouts, or chatbots.
- Content hash
- sha256:37964e81b94fc854ab9a07e2d01b3ba51192ef642fc79563dba41c7270038ff3
- Files
- 2
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md24.2 KB
- examples.md14.1 KB
Ahuggingface-local-models
skills/huggingface-local-models100/100 · No meaningful risk foundNo security findings
huggingface-local-models
skills/huggingface-local-modelsUse to select models to run locally with llama.cpp and GGUF on CPU, Mac Metal, CUDA, or ROCm. Covers finding GGUFs, quant selection, running servers, exact GGUF file lookup, conversion, and OpenAI-compatible local serving.
- Content hash
- sha256:76c02ccc26b251e8f544c028aad960f02e574afa2aa3ec44c9dac30793fe0e86
- Files
- 4
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md3.7 KB
- references/hardware.md623 B
- references/hub-discovery.md5.2 KB
- references/quantization.md6.0 KB
Ahuggingface-lora-space-builder
skills/huggingface-lora-space-builder100/100 · No meaningful risk foundNo security findings
huggingface-lora-space-builder
skills/huggingface-lora-space-builderBuild and publish a Gradio demo on Hugging Face Spaces for a user-provided LoRA. Use when someone asks to create, generate, ship, or publish a Space, demo, Gradio app, or playground for a LoRA — including LoRAs for Qwen-Image, Qwen-Image-Edit, LTX-Video, Wan, FLUX, SDXL, or other diffusion base models. Also triggers when someone describes a LoRA they trained or hosts on the Hub and wants to share it. Covers picking the right base pipeline and `diffusers` inference recipe, designing a UI tailored to the LoRA's task and inputs (Union/multi-task control, edit, video, image, etc.), respecting model-card recommendations (trigger words, steps, guidance, LoRA scale, example inputs), and shipping to ZeroGPU hardware as a private Space by default.
- Content hash
- sha256:084f28216185ccbbf2f03b2c227a20fc63bb2ec2f2152731e3d0c3c77c938bfd
- Files
- 8
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md33.0 KB
- references/adapting-to-the-lora.md13.5 KB
- references/creative-mode.md18.7 KB
- references/tasks.md10.1 KB
- references/zerogpu-and-publishing.md14.2 KB
- references/base-models/krea-2.md4.0 KB
- references/base-models/ltx.md15.0 KB
- references/base-models/qwen-image.md7.3 KB
Ahuggingface-paper-publisher
skills/huggingface-paper-publisher100/100 · No meaningful risk foundNo security findings
huggingface-paper-publisher
skills/huggingface-paper-publisherPublish and manage research papers on Hugging Face Hub. Supports creating paper pages, linking papers to models/datasets, claiming authorship, and generating professional markdown-based research articles.
- Content hash
- sha256:7f4b96eb979a8d5543313983abe799581398127ed1115f3b179d584968c53480
- Files
- 8
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Quality
- infoSKILL.md is longSL705 · skills/huggingface-paper-publisher/SKILL.md:1
625 linesLong skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.
Files in this skill
- SKILL.md16.3 KB
- examples/example_usage.md8.3 KB
- references/quick_reference.md4.4 KB
- scripts/paper_manager.py21.4 KB
- templates/arxiv.md7.1 KB
- templates/ml-report.md6.7 KB
- templates/modern.md6.3 KB
- templates/standard.md3.1 KB
Ahuggingface-papers
skills/huggingface-papers100/100 · No meaningful risk foundNo security findings
huggingface-papers
skills/huggingface-papersLook up and read Hugging Face paper pages in markdown, and use the papers API for structured metadata such as authors, linked models/datasets/spaces, Github repo and project page. Use when the user shares a Hugging Face paper page URL, an arXiv URL or ID, or asks to summarize, explain, or analyze an AI research paper.
- Content hash
- sha256:dec207c3de03859dd78649f5753e0ba700cde696087073f614a2033e19b1b402
- Files
- 1
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md9.1 KB
Ahuggingface-tool-builder
skills/huggingface-tool-builder100/100 · No meaningful risk foundNo security findings
huggingface-tool-builder
skills/huggingface-tool-builderUse this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. This is especially useful when chaining or combining API calls or the task will be repeated/automated. This Skill creates a reusable script to fetch, enrich or process data.
- Content hash
- sha256:cd3a78c48456b6f532a2dcf0dd2f617e48ffea5fdc873c7df045b9c6aee50d14
- Files
- 8
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md5.8 KB
- references/baseline_hf_api.py1.3 KB
- references/baseline_hf_api.sh707 B
- references/baseline_hf_api.tsx1.2 KB
- references/find_models_by_paper.sh7.5 KB
- references/hf_enrich_models.sh2.2 KB
- references/hf_model_card_frontmatter.sh4.4 KB
- references/hf_model_papers_auth.sh4.7 KB
Ahuggingface-vision-trainer
skills/huggingface-vision-trainer100/100 · No meaningful risk foundNo security findings
huggingface-vision-trainer
skills/huggingface-vision-trainerTrains and fine-tunes vision models for object detection (D-FINE, RT-DETR v2, DETR, YOLOS), image classification (timm models — MobileNetV3, MobileViT, ResNet, ViT/DINOv3 — plus any Transformers classifier), and SAM/SAM2 segmentation using Hugging Face Transformers on Hugging Face Jobs cloud GPUs. Covers COCO-format dataset preparation, Albumentations augmentation, mAP/mAR evaluation, accuracy metrics, SAM segmentation with bbox/point prompts, DiceCE loss, hardware selection, cost estimation, Trackio monitoring, and Hub persistence. Use when users mention training object detection, image classification, SAM, SAM2, segmentation, image matting, DETR, D-FINE, RT-DETR, ViT, timm, MobileNet, ResNet, bounding box models, or fine-tuning vision models on Hugging Face Jobs.
- Content hash
- sha256:8ef38277b09da5bc768d984e8fb9447f28af65fc69b39ca37c08697d3e720a1f
- Files
- 12
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Quality
- infoSKILL.md is longSL705 · skills/huggingface-vision-trainer/SKILL.md:1
594 linesLong skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.
Files in this skill
- SKILL.md29.5 KB
- references/finetune_sam2_trainer.md6.3 KB
- references/hub_saving.md16.6 KB
- references/image_classification_training_notebook.md10.8 KB
- references/object_detection_training_notebook.md29.2 KB
- references/reliability_principles.md9.3 KB
- references/timm_trainer.md3.5 KB
- scripts/dataset_inspector.py31.1 KB
- scripts/estimate_cost.py7.2 KB
- scripts/image_classification_training.py13.1 KB
- scripts/object_detection_training.py26.7 KB
- scripts/sam_segmentation_training.py13.6 KB
Atrl-training
skills/trl-training100/100 · No meaningful risk foundNo security findings
trl-training
skills/trl-trainingPost-train LLMs with TRL (Transformers Reinforcement Learning) — SFT, DPO, GRPO, KTO, and reward-model training. Use when writing or debugging training code with the TRL Python API or the trl CLI.
- Content hash
- sha256:408175bc02971f9da4a3affa5f1648d9300ab52b36c8c74c83bd1aabd390bfcb
- Files
- 1
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md4.2 KB
Static analysis finds known risky patterns. It cannot prove a skill is safe. Pin what you reviewed with a lockfile so changes are caught.