skillhash

Security report · 6h ago

huggingface/skills

Grade C, 68/100Review before installing26 skills · 159 files · engine 0.2.0
c3ff942be3e0
C

hf-cloud-aws-context-discovery

skills/hf-cloud-aws-context-discovery
68/100 · Review before installing3 high2 low

Discover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.

Content hash
sha256:aa7b422046bc2b76cfd8ca888767d45e46d5c3657c86589947d52c8cb631dd0f
Files
1
Quality
100/100

Security findings

  • highReads credential filesSL201 · skills/hf-cloud-aws-context-discovery/SKILL.md:16
    `AWS_PROFILE` env var, else `default`. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in `~/.aws/config`, …

    The skill references files that hold private keys or cloud credentials. Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.

  • highReads credential filesSL201 · skills/hf-cloud-aws-context-discovery/SKILL.md:24
    4. `region` field on the active profile in `~/.aws/config`

    The skill references files that hold private keys or cloud credentials. Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.

  • highReads credential filesSL201 · skills/hf-cloud-aws-context-discovery/SKILL.md:64
    `aws configure list` handles env-var overrides and shows the resolved effective values. Prefer it over parsing `~/.aws/config` yourself. If you need to read ra…

    The skill references files that hold private keys or cloud credentials. Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.

  • lowHides actions from the userSL102 · skills/hf-cloud-aws-context-discovery/SKILL.md:8
    Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers.

    The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

  • lowHides actions from the userSL102 · skills/hf-cloud-aws-context-discovery/SKILL.md:72
    Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.

    The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md3.9 KB
C

hf-cli

skills/hf-cli
74/100 · Review before installing1 high

Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`.

Content hash
sha256:f2e6dba382dccfb4975ade236affcf9a009abdc60a91191609a00595730f66eb
Files
1
Quality
100/100

Security findings

  • highPipes a download into a shellSL301 · skills/hf-cli/SKILL.md:6
    Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`.

    Remote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine. Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill.

Files in this skill
  • SKILL.md33.2 KB
A

huggingface-trackio

skills/huggingface-trackio
92/100 · No meaningful risk found2 medium

Track and visualize ML training experiments with Trackio. Use when logging metrics during training (Python API), firing alerts for training diagnostics, or retrieving/analyzing logged metrics (CLI). Supports real-time dashboard visualization, alerts with webhooks, HF Space syncing, and JSON output for automation.

Content hash
sha256:e064ddc0cca411aafb45189dad25083dcd1179bc4df4ec988f197b9e8b424a6d
Files
4
Quality
100/100

Security findings

  • mediumKnown exfiltration endpointSL204 · skills/huggingface-trackio/references/alerts.md:35
    webhook_url="https://hooks.slack.com/services/...",

    The skill talks to a service commonly used to receive stolen data. Fix: Remove the endpoint, or replace it with a documented API the user owns. Severity lowered: the line reads as documentation, not an instruction.

  • mediumKnown exfiltration endpointSL204 · skills/huggingface-trackio/references/alerts.md:46
    webhook_url="https://hooks.slack.com/services/...", # Overrides global URL

    The skill talks to a service commonly used to receive stolen data. Fix: Remove the endpoint, or replace it with a documented API the user owns. Severity lowered: the line reads as documentation, not an instruction.

  • infoUnpinned package installSL501 · skills/huggingface-trackio/references/logging_metrics.md:11
    pip install trackio

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

  • infoUnpinned package installSL501 · skills/huggingface-trackio/references/logging_metrics.md:13
    uv pip install trackio

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md5.0 KB
  • references/alerts.md5.8 KB
  • references/logging_metrics.md5.4 KB
  • references/retrieving_metrics.md8.5 KB
A

huggingface-community-evals

skills/huggingface-community-evals
94/100 · No meaningful risk found1 medium

Run evaluations for Hugging Face Hub models using inspect-ai and lighteval on local hardware. Use for backend selection, local GPU evals, and choosing between vLLM / Transformers / accelerate. Not for HF Jobs orchestration, model-card PRs, .eval_results publication, or community-evals automation.

Content hash
sha256:363ca54bbc69986df1634b288b790725b86988c7d45259bb723cef9fe6e05239
Files
6
Quality
100/100

Security findings

  • mediumDumps environment variablesSL202 · skills/huggingface-community-evals/SKILL.md:47
    printenv HF_TOKEN >/dev/null

    The skill collects every environment variable, which usually includes API keys and tokens. Fix: Read only the specific variable you need, by name.

Files in this skill
  • SKILL.md6.4 KB
  • examples/.env.example159 B
  • examples/USAGE_EXAMPLES.md2.0 KB
  • scripts/inspect_eval_uv.py2.9 KB
  • scripts/inspect_vllm_uv.py8.9 KB
  • scripts/lighteval_vllm_uv.py9.0 KB
A

huggingface-spaces

skills/huggingface-spaces
94/100 · No meaningful risk found5 low

Build, deploy, and maintain applications on Hugging Face Spaces — Gradio / Docker / Static SDKs, ZeroGPU and dedicated hardware, model loading, debugging, buckets, inference providers, community grants. Use whenever the user asks to create or host an app on Hugging Face, port code onto ZeroGPU, fix a Space that won't build or run, or otherwise work with `hf spaces …`, `@spaces.GPU`, Space README frontmatter, or the `spaces` Python package.

Content hash
sha256:76e63ff9317995dbd0d81493159b42252218b09318121c49c34f90ddbc1964df
Files
15
Quality
100/100

Security findings

  • lowInstalls code straight from a URLSL502 · skills/huggingface-spaces/references/3d-models.md:126
    shlex.split("pip install --no-build-isolation git+https://github.com/tatsy/torchmcubes.git"),

    The dependency is fetched from a mutable URL or branch. Fix: Pin to a commit SHA or a published version with a checksum. Severity lowered: the line reads as documentation, not an instruction.

  • lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/debugging.md:110
    r = httpx.post(f"https://<subdomain>.hf.space/your_route",

    The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

  • lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/debugging.md:181
    curl -s -X POST \

    The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

  • lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/debugging.md:223
    curl -s -X POST -H "Authorization: Bearer $HF_TOKEN" \

    The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

  • lowUploads data to a remote hostSL203 · skills/huggingface-spaces/references/known-errors.md:217
    **Fix**: For streaming, use `client.submit(...).result()` (or iterate the job). For custom routes, use `httpx.post(base_url + "/route", ...)` directly — bypass…

    The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

  • infoInstalls code straight from a URLSL502 · skills/huggingface-spaces/references/3d-gsplat.md:23
    **Shape B — a real rasterizer (only for server-rendered orbit videos).** If the code uses the upstream Inria API, take the prebuilt wheel from `requirements.md…

    The dependency is fetched from a mutable URL or branch. Fix: Pin to a commit SHA or a published version with a checksum. Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • README.md412 B
  • SKILL.md17.5 KB
  • references/3d-cuda-extensions.md9.1 KB
  • references/3d-generation.md8.6 KB
  • references/3d-gsplat.md7.2 KB
  • references/3d-models.md19.6 KB
  • references/3d-outputs.md9.3 KB
  • references/buckets.md4.3 KB
  • references/debugging.md11.3 KB
  • references/gradio.md9.2 KB
  • references/grants.md3.1 KB
  • references/inference-providers.md3.8 KB
  • references/known-errors.md13.3 KB
  • references/requirements.md11.3 KB
  • references/zerogpu.md20.9 KB
A

train-sentence-transformers

skills/train-sentence-transformers
94/100 · No meaningful risk found1 medium

Train or fine-tune sentence-transformers models across `SentenceTransformer` (bi-encoder, dense or static embedding model for retrieval, similarity, clustering, classification, paraphrase mining, dedup, multimodal), `CrossEncoder` (reranker, pair scoring for two-stage retrieval / pair classification), `SparseEncoder` (SPLADE, sparse embedding model for learned-sparse retrieval), and `MultiVectorEncoder` (ColBERT / late-interaction, per-token embeddings scored with MaxSim). Covers loss selection, hard-negative mining, evaluators, distillation, LoRA, Matryoshka, and Hugging Face Hub publishing. Use for any sentence-transformers training task.

Content hash
sha256:07598caaed95b6c6e971fa05e5aba2d8adc1677bea2d9015c0c10ade2bf59eb8
Files
31
Quality
100/100

Security findings

  • mediumPipes a download into a shellSL301 · skills/train-sentence-transformers/references/hf_jobs_execution.md:9
    - Access to the `hf_jobs()` MCP tool, or the `hf` CLI (`curl -LsSf https://hf.co/cli/install.sh | bash -s`).

    Remote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine. Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill. Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md10.3 KB
  • references/base_model_selection.md7.5 KB
  • references/dataset_formats.md6.3 KB
  • references/evaluators_cross_encoder.md5.5 KB
  • references/evaluators_multi_vector_encoder.md6.6 KB
  • references/evaluators_sentence_transformer.md5.8 KB
  • references/evaluators_sparse_encoder.md4.9 KB
  • references/hardware_guide.md5.9 KB
  • references/hf_jobs_execution.md7.1 KB
  • references/losses_cross_encoder.md9.5 KB
  • references/losses_multi_vector_encoder.md10.5 KB
  • references/losses_sentence_transformer.md10.7 KB
  • references/losses_sparse_encoder.md5.1 KB
  • references/model_architectures.md9.0 KB
  • references/prompts_and_instructions.md6.4 KB
  • references/training_args.md15.0 KB
  • references/troubleshooting.md12.9 KB
  • scripts/mine_hard_negatives.py8.3 KB
  • scripts/train_cross_encoder_distillation_example.py9.2 KB
  • scripts/train_cross_encoder_example.py9.0 KB
  • scripts/train_cross_encoder_listwise_example.py10.2 KB
  • scripts/train_multi_vector_encoder_example.py8.8 KB
  • scripts/train_sentence_transformer_distillation_example.py11.9 KB
  • scripts/train_sentence_transformer_example.py7.5 KB
  • scripts/train_sentence_transformer_make_multilingual_example.py11.5 KB
  • scripts/train_sentence_transformer_matryoshka_example.py7.1 KB
  • scripts/train_sentence_transformer_multi_dataset_example.py9.9 KB
  • scripts/train_sentence_transformer_static_embedding_example.py10.3 KB
  • scripts/train_sentence_transformer_with_lora_example.py10.3 KB
  • scripts/train_sparse_encoder_distillation_example.py9.4 KB
  • scripts/train_sparse_encoder_example.py8.1 KB
A

huggingface-llm-trainer

skills/huggingface-llm-trainer
96/100 · No meaningful risk found6 low

Train or fine-tune language and vision models using TRL (Transformer Reinforcement Learning) or Unsloth with Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward modeling training methods, plus GGUF conversion for local deployment. Includes guidance on the TRL Jobs package, UV scripts with PEP 723 format, dataset preparation and validation, hardware selection, cost estimation, Trackio monitoring, Hub authentication, model selection/leaderboards and model persistence. Use for tasks involving cloud GPU training, GGUF conversion, or when users mention training on Hugging Face Jobs without local GPU setup.

Content hash
sha256:a3d33f07e5180e179ee79aed996a0c19c68bdac123fbcb69c34f2685dc48ceae
Files
19
Quality
100/100

Security findings

  • lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:27
    - Ubuntu/Debian: sudo apt-get update && sudo apt-get install -y build-essential cmake

    The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

  • lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:28
    - RHEL/CentOS: sudo yum groupinstall -y "Development Tools" && sudo yum install -y cmake

    The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

  • lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:57
    print(" Ubuntu/Debian: sudo apt-get install git")

    The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

  • lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:58
    print(" RHEL/CentOS: sudo yum install git")

    The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

  • lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:68
    print(" Ubuntu/Debian: sudo apt-get install build-essential cmake")

    The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

  • lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:69
    print(" RHEL/CentOS: sudo yum groupinstall 'Development Tools' && sudo yum install cmake")

    The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

Quality

  • infoSKILL.md is longSL705 · skills/huggingface-llm-trainer/SKILL.md:1
    739 lines

    Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

Files in this skill
  • SKILL.md28.1 KB
  • references/gguf_conversion.md9.6 KB
  • references/hardware_guide.md6.6 KB
  • references/hub_saving.md8.3 KB
  • references/local_training_macos.md8.1 KB
  • references/reliability_principles.md10.6 KB
  • references/trackio_guide.md6.3 KB
  • references/training_methods.md4.9 KB
  • references/training_patterns.md6.0 KB
  • references/troubleshooting.md8.7 KB
  • references/unsloth.md7.8 KB
  • scripts/convert_to_gguf.py12.3 KB
  • scripts/dataset_inspector.py15.3 KB
  • scripts/estimate_cost.py4.7 KB
  • scripts/hf_benchmarks.py19.6 KB
  • scripts/train_dpo_example.py3.0 KB
  • scripts/train_grpo_example.py2.3 KB
  • scripts/train_sft_example.py3.3 KB
  • scripts/unsloth_sft_example.py16.5 KB
A

hf-cloud-sagemaker-deployment-planner

skills/hf-cloud-sagemaker-deployment-planner
98/100 · No meaningful risk found1 low

Plan and coordinate the deployment of a model to Amazon SageMaker AI. Use this skill whenever the user wants to deploy, host, serve, or expose a model on SageMaker or AWS — including phrases like "deploy a model", "host this LLM on AWS", "serve this embedding model", "deploy a reranker", "deploy a text-to-image / diffusion model", "host this for async inference", "create an endpoint", "serve my fine-tuned model", or any request that involves making a model available for inference on AWS. Use this even when the user is vague (e.g. "I just want to get this running on AWS, you figure it out"). Works for text-generation LLMs, embedding models, rerankers, classifiers, text-to-image / diffusion models — picks the right serving stack and chooses between real-time and async inference. This is the entry-point skill for SageMaker deployment work — it asks clarifying questions, picks a deployment pathway, and coordinates the other deployment skills.

Content hash
sha256:153150455ceef0e532512b4b53e00525c5d85390567f6e3f29e5e8e73b974c35
Files
1
Quality
100/100

Security findings

  • lowHides actions from the userSL102 · skills/hf-cloud-sagemaker-deployment-planner/SKILL.md:70
    If the call itself is denied, say so once and continue. The quota check is an optimization, not a gate: the deployment surfaces the real limit as `ResourceLimi…

    The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md8.4 KB
A

huggingface-datasets

skills/huggingface-datasets
98/100 · No meaningful risk found2 low

Use this skill for Hugging Face Dataset Viewer API workflows that fetch subset/split metadata, paginate rows, search text, apply filters, download parquet URLs, and read size or statistics.

Content hash
sha256:2502296e92ca38813dd7f73bf33f53bd27d7ca629487b4afeeb7c58bedef0619
Files
1
Quality
100/100

Security findings

  • lowUnpinned package installSL501 · skills/huggingface-datasets/SKILL.md:83
    npx -y @huggingface/hub upload datasets/<namespace>/<repo> ./local/parquet-folder data

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

  • lowUnpinned package installSL501 · skills/huggingface-datasets/SKILL.md:89
    npx -y @huggingface/hub upload datasets/<namespace>/<repo> ./local/parquet-folder data --private

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Files in this skill
  • SKILL.md4.6 KB
A

huggingface-zerogpu

skills/huggingface-zerogpu
98/100 · No meaningful risk found1 low

AI demos and GPU compute with Gradio Spaces and Hugging Face Spaces ZeroGPU. Use when writing or reviewing code that uses `@spaces.GPU`, configuring `python_version` or `requirements.txt` for a ZeroGPU Space, or handling ZeroGPU-specific code constraints — pickle-based process isolation, `gr.State` semantics across the worker boundary, no `torch.compile` (use AoTI instead), CUDA wheel-only builds (no `nvcc` at build or runtime), large vs xlarge sizing, and dynamic duration callables. Make sure to use this skill whenever the user mentions ZeroGPU, `@spaces.GPU`, or the `spaces` Python package, or hits ZeroGPU-specific code errors like `PicklingError` across the worker boundary, `illegal duration`, or `flash-attn` wheel-build failures — even when the user does not explicitly ask for ZeroGPU coding guidance. Trigger on `import spaces` or `@spaces.GPU` in code.

Content hash
sha256:e4519bc1a792b58f201625139270c67c9e844d667d00020954b2f975864bd34e
Files
5
Quality
100/100

Security findings

  • lowHides actions from the userSL102 · skills/huggingface-zerogpu/SKILL.md:81
    Do not run inference or CUDA kernels at module scope — the real GPU is not attached, so operations either silently run on CPU or fail.

    The skill asks the agent to act without the user's knowledge. Fix: Every side effect should be visible to the user. Remove the concealment instruction. Severity lowered: the line reads as documentation, not an instruction.

Files in this skill
  • SKILL.md17.8 KB
  • references/concurrency.md2.5 KB
  • references/cuda-and-deps.md4.7 KB
  • references/how-quota-works.md3.8 KB
  • references/how-zerogpu-works.md4.7 KB
A

transformers-js

skills/transformers-js
98/100 · No meaningful risk found2 low

Use Transformers.js to run state-of-the-art machine learning models directly in JavaScript/TypeScript. Supports NLP (text classification, translation, summarization), computer vision (image classification, object detection), audio (speech recognition, audio classification), and multimodal tasks. Works in browsers and server-side runtimes (Node.js, Bun, Deno) with WebGPU/WASM using pre-trained models from Hugging Face Hub.

Content hash
sha256:2f2c4c9382a143cc30894152981b44affce69ad140cb057d4f5e9df06d9860c3
Files
8
Quality
100/100

Security findings

  • lowUnpinned package installSL501 · skills/transformers-js/SKILL.md:30
    npm install @huggingface/transformers

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

  • lowUnpinned package installSL501 · skills/transformers-js/SKILL.md:457
    npm install @huggingface/tokenizers

    Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

Quality

  • infoSKILL.md is longSL705 · skills/transformers-js/SKILL.md:1
    693 lines

    Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

Files in this skill
  • SKILL.md24.3 KB
  • references/CACHE.md9.0 KB
  • references/CONFIGURATION.md10.8 KB
  • references/EXAMPLES.md15.3 KB
  • references/MODEL_ARCHITECTURES.md5.5 KB
  • references/MODEL_REGISTRY.md5.9 KB
  • references/PIPELINE_OPTIONS.md14.6 KB
  • references/TEXT_GENERATION.md7.7 KB
A

hf-mcp

hf-mcp/skills/hf-mcp
100/100 · No meaningful risk foundNo security findings

Use Hugging Face Hub via MCP server tools. Search models, datasets, Spaces, papers. Get repo details, fetch documentation, run compute jobs, and use Gradio Spaces as AI tools. Available when connected to the HF MCP server.

Content hash
sha256:8905cafa9d5263941be0454ef2ddbffc260a2a2de5f9ceef8fb1a38f1808354c
Files
1
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md4.9 KB
A

hf-cloud-python-env-setup

skills/hf-cloud-python-env-setup
100/100 · No meaningful risk foundNo security findings

Set up an isolated Python environment for SageMaker / AWS work, with the right Python version and current boto3. Use this skill whenever Python code will be executed for a SageMaker deployment, training job, or any AWS automation — including when about to run `pip install`, when about to invoke `boto3`, when creating or activating a virtualenv, or when the user asks to "set up the environment". Never use system Python and never `pip install` into it. Always isolate. This skill prevents the most common failure modes: wrong Python version, dependency conflicts, and stale SDKs.

Content hash
sha256:85e3fcd0bd164e3fb385f066b75a96f202acde7fcb2ef7def1332bad1058cec0
Files
4
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md6.6 KB
  • requirements.txt796 B
  • scripts/check_versions.py740 B
  • scripts/setup_env.py4.9 KB
A

hf-cloud-sagemaker-iam-preflight

skills/hf-cloud-sagemaker-iam-preflight
100/100 · No meaningful risk foundNo security findings

Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.

Content hash
sha256:0c45a20c9fa142609926d17521810b04ddf83f9a448c502e9bf0ea1fcf4b3e6d
Files
5
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md6.9 KB
  • references/minimum-permissions.json1.0 KB
  • references/trust-policy.json197 B
  • scripts/check_role.py6.7 KB
  • scripts/create_role.py3.8 KB
A

hf-cloud-sagemaker-production-defaults

skills/hf-cloud-sagemaker-production-defaults
100/100 · No meaningful risk foundNo security findings

Create a SageMaker endpoint (real-time, real-time scale-to-zero, or async) with autoscaling, CloudWatch alarms, and tagging enabled by default. Use this skill whenever about to create a SageMaker endpoint, write deployment code that calls `create_endpoint`, or finalize a deployment after the image URI and IAM role are known. Provides deploy.py for real-time endpoints, deploy_ic.py for real-time endpoints that scale to zero instances via inference components, and deploy_async.py for async endpoints (also scale-to-zero). This is the last step in the SageMaker deployment workflow. Never generate a bare `create_endpoint` call without these defaults — endpoints without autoscaling or alarms are demos, not deployments.

Content hash
sha256:a1a69b18bf7178dab3fd3d128d477287ed014d7f9ae71f0df862145ce05832c4
Files
8
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md27.0 KB
  • references/deployment-template.md3.6 KB
  • scripts/_common.py4.8 KB
  • scripts/deploy.py12.7 KB
  • scripts/deploy_async.py18.1 KB
  • scripts/deploy_ic.py20.2 KB
  • scripts/invoke_endpoint.py6.4 KB
  • scripts/teardown.py9.2 KB
A

hf-cloud-serving-image-selection

skills/hf-cloud-serving-image-selection
100/100 · No meaningful risk foundNo security findings

Pick the right serving container for a SageMaker model deployment and find its current image URI. Use this skill whenever about to deploy a model to a SageMaker endpoint and an image URI needs to be chosen — including when the user says "deploy this LLM", "host this HuggingFace model", "serve this fine-tuned model", "deploy this embedding model", "host a reranker", "serve a sentence-transformers model", or when about to hardcode any container URI in deployment code. HuggingFace-curated Deep Learning Containers are ALWAYS preferred: HuggingFace vLLM (LLMs and generative rerankers), HuggingFace vLLM-Omni (multimodal), TEI (embeddings/cross-encoder rerankers), HF Inference Toolkit (other transformers). Generic images (AWS vLLM, DJL-LMI, SGLang) are used only when no HuggingFace image is compatible — never merely because they carry a newer version. Never hardcode a container URI from memory and never default to TGI. Prevents stale-image failures and wrong-region URIs.

Content hash
sha256:a284c45d651d3d0c4745ce815fcf5a9851f223b19ff667bf65a564811677434e
Files
3
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md18.1 KB
  • references/model-to-image.md10.6 KB
  • scripts/mirror_image.py4.7 KB
A

hf-mem

skills/hf-mem
100/100 · No meaningful risk foundNo security findings

Hugging Face CLI to estimate the required memory to load Safetensors or GGUF model weights for inference from the Hugging Face Hub

Content hash
sha256:21fc28bcb9369e6924a708fd6db366dc9416a985417f64df9e314c866fae8d09
Files
1
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md3.2 KB
A

huggingface-best

skills/huggingface-best
100/100 · No meaningful risk foundNo security findings

Use when the user asks about finding the best, top, or recommended model for a task, wants to know what AI model to use, or wants to compare models by benchmark scores. Triggers on: "best model for X", "what model should I use for", "top models for [task]", "which model runs on my laptop/machine/device", "recommend a model for", "what LLM should I use for", "compare models for", "what's state of the art for", or any question about choosing an AI model for a specific use case. Always use this skill when the user wants model recommendations or comparisons, even if they don't explicitly mention HuggingFace or benchmarks.

Content hash
sha256:fc492781c6b3a28458dcff23f6537f7a8c2d2ce64517e80d4616ae375ab734f5
Files
1
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md5.7 KB
A

huggingface-gradio

skills/huggingface-gradio
100/100 · No meaningful risk foundNo security findings

Build Gradio web UIs and demos in Python. Use when creating or editing Gradio apps, components, event listeners, layouts, or chatbots.

Content hash
sha256:37964e81b94fc854ab9a07e2d01b3ba51192ef642fc79563dba41c7270038ff3
Files
2
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md24.2 KB
  • examples.md14.1 KB
A

huggingface-local-models

skills/huggingface-local-models
100/100 · No meaningful risk foundNo security findings

Use to select models to run locally with llama.cpp and GGUF on CPU, Mac Metal, CUDA, or ROCm. Covers finding GGUFs, quant selection, running servers, exact GGUF file lookup, conversion, and OpenAI-compatible local serving.

Content hash
sha256:76c02ccc26b251e8f544c028aad960f02e574afa2aa3ec44c9dac30793fe0e86
Files
4
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md3.7 KB
  • references/hardware.md623 B
  • references/hub-discovery.md5.2 KB
  • references/quantization.md6.0 KB
A

huggingface-lora-space-builder

skills/huggingface-lora-space-builder
100/100 · No meaningful risk foundNo security findings

Build and publish a Gradio demo on Hugging Face Spaces for a user-provided LoRA. Use when someone asks to create, generate, ship, or publish a Space, demo, Gradio app, or playground for a LoRA — including LoRAs for Qwen-Image, Qwen-Image-Edit, LTX-Video, Wan, FLUX, SDXL, or other diffusion base models. Also triggers when someone describes a LoRA they trained or hosts on the Hub and wants to share it. Covers picking the right base pipeline and `diffusers` inference recipe, designing a UI tailored to the LoRA's task and inputs (Union/multi-task control, edit, video, image, etc.), respecting model-card recommendations (trigger words, steps, guidance, LoRA scale, example inputs), and shipping to ZeroGPU hardware as a private Space by default.

Content hash
sha256:084f28216185ccbbf2f03b2c227a20fc63bb2ec2f2152731e3d0c3c77c938bfd
Files
8
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md33.0 KB
  • references/adapting-to-the-lora.md13.5 KB
  • references/creative-mode.md18.7 KB
  • references/tasks.md10.1 KB
  • references/zerogpu-and-publishing.md14.2 KB
  • references/base-models/krea-2.md4.0 KB
  • references/base-models/ltx.md15.0 KB
  • references/base-models/qwen-image.md7.3 KB
A

huggingface-paper-publisher

skills/huggingface-paper-publisher
100/100 · No meaningful risk foundNo security findings

Publish and manage research papers on Hugging Face Hub. Supports creating paper pages, linking papers to models/datasets, claiming authorship, and generating professional markdown-based research articles.

Content hash
sha256:7f4b96eb979a8d5543313983abe799581398127ed1115f3b179d584968c53480
Files
8
Quality
100/100

Security findings

None of the 30 rules matched.

Quality

  • infoSKILL.md is longSL705 · skills/huggingface-paper-publisher/SKILL.md:1
    625 lines

    Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

Files in this skill
  • SKILL.md16.3 KB
  • examples/example_usage.md8.3 KB
  • references/quick_reference.md4.4 KB
  • scripts/paper_manager.py21.4 KB
  • templates/arxiv.md7.1 KB
  • templates/ml-report.md6.7 KB
  • templates/modern.md6.3 KB
  • templates/standard.md3.1 KB
A

huggingface-papers

skills/huggingface-papers
100/100 · No meaningful risk foundNo security findings

Look up and read Hugging Face paper pages in markdown, and use the papers API for structured metadata such as authors, linked models/datasets/spaces, Github repo and project page. Use when the user shares a Hugging Face paper page URL, an arXiv URL or ID, or asks to summarize, explain, or analyze an AI research paper.

Content hash
sha256:dec207c3de03859dd78649f5753e0ba700cde696087073f614a2033e19b1b402
Files
1
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md9.1 KB
A

huggingface-tool-builder

skills/huggingface-tool-builder
100/100 · No meaningful risk foundNo security findings

Use this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. This is especially useful when chaining or combining API calls or the task will be repeated/automated. This Skill creates a reusable script to fetch, enrich or process data.

Content hash
sha256:cd3a78c48456b6f532a2dcf0dd2f617e48ffea5fdc873c7df045b9c6aee50d14
Files
8
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md5.8 KB
  • references/baseline_hf_api.py1.3 KB
  • references/baseline_hf_api.sh707 B
  • references/baseline_hf_api.tsx1.2 KB
  • references/find_models_by_paper.sh7.5 KB
  • references/hf_enrich_models.sh2.2 KB
  • references/hf_model_card_frontmatter.sh4.4 KB
  • references/hf_model_papers_auth.sh4.7 KB
A

huggingface-vision-trainer

skills/huggingface-vision-trainer
100/100 · No meaningful risk foundNo security findings

Trains and fine-tunes vision models for object detection (D-FINE, RT-DETR v2, DETR, YOLOS), image classification (timm models — MobileNetV3, MobileViT, ResNet, ViT/DINOv3 — plus any Transformers classifier), and SAM/SAM2 segmentation using Hugging Face Transformers on Hugging Face Jobs cloud GPUs. Covers COCO-format dataset preparation, Albumentations augmentation, mAP/mAR evaluation, accuracy metrics, SAM segmentation with bbox/point prompts, DiceCE loss, hardware selection, cost estimation, Trackio monitoring, and Hub persistence. Use when users mention training object detection, image classification, SAM, SAM2, segmentation, image matting, DETR, D-FINE, RT-DETR, ViT, timm, MobileNet, ResNet, bounding box models, or fine-tuning vision models on Hugging Face Jobs.

Content hash
sha256:8ef38277b09da5bc768d984e8fb9447f28af65fc69b39ca37c08697d3e720a1f
Files
12
Quality
100/100

Security findings

None of the 30 rules matched.

Quality

  • infoSKILL.md is longSL705 · skills/huggingface-vision-trainer/SKILL.md:1
    594 lines

    Long skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.

Files in this skill
  • SKILL.md29.5 KB
  • references/finetune_sam2_trainer.md6.3 KB
  • references/hub_saving.md16.6 KB
  • references/image_classification_training_notebook.md10.8 KB
  • references/object_detection_training_notebook.md29.2 KB
  • references/reliability_principles.md9.3 KB
  • references/timm_trainer.md3.5 KB
  • scripts/dataset_inspector.py31.1 KB
  • scripts/estimate_cost.py7.2 KB
  • scripts/image_classification_training.py13.1 KB
  • scripts/object_detection_training.py26.7 KB
  • scripts/sam_segmentation_training.py13.6 KB
A

trl-training

skills/trl-training
100/100 · No meaningful risk foundNo security findings

Post-train LLMs with TRL (Transformers Reinforcement Learning) — SFT, DPO, GRPO, KTO, and reward-model training. Use when writing or debugging training code with the TRL Python API or the trl CLI.

Content hash
sha256:408175bc02971f9da4a3affa5f1648d9300ab52b36c8c74c83bd1aabd390bfcb
Files
1
Quality
100/100

Security findings

None of the 30 rules matched.

Files in this skill
  • SKILL.md4.2 KB

Static analysis finds known risky patterns. It cannot prove a skill is safe. Pin what you reviewed with a lockfile so changes are caught.

Scan another skill

No sign-up needed. Try