Is huggingface-llm-trainer safe?
Grade A, 96/100. No meaningful risk found.
Train or fine-tune language and vision models using TRL (Transformer Reinforcement Learning) or Unsloth with Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward modeling training methods, plus GGUF conversion for local deployment. Includes guidance on the TRL Jobs package, UV scripts with PEP 723 format, dataset preparation and validation, hardware selection, cost estimation, Trackio monitoring, Hub authentication, model selection/leaderboards and model persistence. Use for tasks involving cloud GPU training, GGUF conversion, or when users mention training on Hugging Face Jobs without local GPU setup.
Ahuggingface-llm-trainer
skills/huggingface-llm-trainer96/100 · No meaningful risk found6 low
huggingface-llm-trainer
skills/huggingface-llm-trainerTrain or fine-tune language and vision models using TRL (Transformer Reinforcement Learning) or Unsloth with Hugging Face Jobs infrastructure. Covers SFT, DPO, GRPO and reward modeling training methods, plus GGUF conversion for local deployment. Includes guidance on the TRL Jobs package, UV scripts with PEP 723 format, dataset preparation and validation, hardware selection, cost estimation, Trackio monitoring, Hub authentication, model selection/leaderboards and model persistence. Use for tasks involving cloud GPU training, GGUF conversion, or when users mention training on Hugging Face Jobs without local GPU setup.
- Content hash
- sha256:a3d33f07e5180e179ee79aed996a0c19c68bdac123fbcb69c34f2685dc48ceae
- Files
- 19
- Quality
- 100/100
Security findings
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:27
- Ubuntu/Debian: sudo apt-get update && sudo apt-get install -y build-essential cmakeThe skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:28
- RHEL/CentOS: sudo yum groupinstall -y "Development Tools" && sudo yum install -y cmakeThe skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:57
print(" Ubuntu/Debian: sudo apt-get install git")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:58
print(" RHEL/CentOS: sudo yum install git")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:68
print(" Ubuntu/Debian: sudo apt-get install build-essential cmake")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
- lowRuns with elevated privilegesSL305 · skills/huggingface-llm-trainer/scripts/convert_to_gguf.py:69
print(" RHEL/CentOS: sudo yum groupinstall 'Development Tools' && sudo yum install cmake")The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
Quality
- infoSKILL.md is longSL705 · skills/huggingface-llm-trainer/SKILL.md:1
739 linesLong skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.
Files in this skill
- SKILL.md28.1 KB
- references/gguf_conversion.md9.6 KB
- references/hardware_guide.md6.6 KB
- references/hub_saving.md8.3 KB
- references/local_training_macos.md8.1 KB
- references/reliability_principles.md10.6 KB
- references/trackio_guide.md6.3 KB
- references/training_methods.md4.9 KB
- references/training_patterns.md6.0 KB
- references/troubleshooting.md8.7 KB
- references/unsloth.md7.8 KB
- scripts/convert_to_gguf.py12.3 KB
- scripts/dataset_inspector.py15.3 KB
- scripts/estimate_cost.py4.7 KB
- scripts/hf_benchmarks.py19.6 KB
- scripts/train_dpo_example.py3.0 KB
- scripts/train_grpo_example.py2.3 KB
- scripts/train_sft_example.py3.3 KB
- scripts/unsloth_sft_example.py16.5 KB
Questions about huggingface-llm-trainer
- Is huggingface-llm-trainer safe to install?
- Our scanner gave huggingface-llm-trainer grade A (96/100): no meaningful risk found. It matched 6 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install huggingface-llm-trainer in Claude Code or Codex?
- Run skillhash add github:huggingface/skills/skills/huggingface-llm-trainer. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if huggingface-llm-trainer changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from huggingface/skills
- A
huggingface-best
11khuggingface/skills
Use when the user asks about finding the best, top, or recommended model for a task, wants to know what AI model to use, or wants to compare models by benchmark scores. Triggers on: "best model for X", "what model should I use for", "top models for [task]", "which model runs on my laptop/machine/device", "recommend a model for", "what LLM should I use for", "compare models for", "what's state of the art for", or any question about choosing an AI model for a specific use case. Always use this skill when the user wants model recommendations or comparisons, even if they don't explicitly mention HuggingFace or benchmarks.
No security findings - A
hf-mem
11khuggingface/skills
Hugging Face CLI to estimate the required memory to load Safetensors or GGUF model weights for inference from the Hugging Face Hub
No security findings - A
hf-cloud-python-env-setup
11khuggingface/skills
Set up an isolated Python environment for SageMaker / AWS work, with the right Python version and current boto3. Use this skill whenever Python code will be executed for a SageMaker deployment, training job, or any AWS automation — including when about to run `pip install`, when about to invoke `boto3`, when creating or activating a virtualenv, or when the user asks to "set up the environment". Never use system Python and never `pip install` into it. Always isolate. This skill prevents the most common failure modes: wrong Python version, dependency conflicts, and stale SDKs.
No security findings - A
hf-mcp
11khuggingface/skills
Use Hugging Face Hub via MCP server tools. Search models, datasets, Spaces, papers. Get repo details, fetch documentation, run compute jobs, and use Gradio Spaces as AI tools. Available when connected to the HF MCP server.
No security findings - A
hf-cloud-serving-image-selection
11khuggingface/skills
Pick the right serving container for a SageMaker model deployment and find its current image URI. Use this skill whenever about to deploy a model to a SageMaker endpoint and an image URI needs to be chosen — including when the user says "deploy this LLM", "host this HuggingFace model", "serve this fine-tuned model", "deploy this embedding model", "host a reranker", "serve a sentence-transformers model", or when about to hardcode any container URI in deployment code. HuggingFace-curated Deep Learning Containers are ALWAYS preferred: HuggingFace vLLM (LLMs and generative rerankers), HuggingFace vLLM-Omni (multimodal), TEI (embeddings/cross-encoder rerankers), HF Inference Toolkit (other transformers). Generic images (AWS vLLM, DJL-LMI, SGLang) are used only when no HuggingFace image is compatible — never merely because they carry a newer version. Never hardcode a container URI from memory and never default to TGI. Prevents stale-image failures and wrong-region URIs.
No security findings - A
hf-cloud-sagemaker-iam-preflight
11khuggingface/skills
Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.
No security findings - A
hf-cloud-sagemaker-production-defaults
11khuggingface/skills
Create a SageMaker endpoint (real-time, real-time scale-to-zero, or async) with autoscaling, CloudWatch alarms, and tagging enabled by default. Use this skill whenever about to create a SageMaker endpoint, write deployment code that calls `create_endpoint`, or finalize a deployment after the image URI and IAM role are known. Provides deploy.py for real-time endpoints, deploy_ic.py for real-time endpoints that scale to zero instances via inference components, and deploy_async.py for async endpoints (also scale-to-zero). This is the last step in the SageMaker deployment workflow. Never generate a bare `create_endpoint` call without these defaults — endpoints without autoscaling or alarms are demos, not deployments.
No security findings - A
huggingface-gradio
11khuggingface/skills
Build Gradio web UIs and demos in Python. Use when creating or editing Gradio apps, components, event listeners, layouts, or chatbots.
No security findings