hf-cli
Manages Hugging Face Hub repositories, models, and datasets using the CLI for efficient AI project workflows.
Install this skill
Security score
The hf-cli skill was audited on May 12, 2026 and we found 13 security issues across 3 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Piping content to bash shell
| 6 | Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`. |
Piping content to sh shell
| 200 | Install: `curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh` |
Curl to non-GitHub URL
| 6 | Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`. |
Webhook reference - potential data exfiltration
| 3 | description: "Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authenti |
Webhook reference - potential data exfiltration
| 178 | ### `hf webhooks` — Manage webhooks on the Hub. |
Webhook reference - potential data exfiltration
| 180 | - `hf webhooks create --watch TEXT` — Create a new webhook. `[--url TEXT --job-id TEXT --domain CHOICE --secret TEXT --format CHOICE]` |
Webhook reference - potential data exfiltration
| 181 | - `hf webhooks delete WEBHOOK_ID` — Delete a webhook permanently. `[--yes --format CHOICE]` |
Webhook reference - potential data exfiltration
| 182 | - `hf webhooks disable WEBHOOK_ID` — Disable an active webhook. `[--format CHOICE]` |
Webhook reference - potential data exfiltration
| 183 | - `hf webhooks enable WEBHOOK_ID` — Enable a disabled webhook. `[--format CHOICE]` |
Webhook reference - potential data exfiltration
| 184 | - `hf webhooks info WEBHOOK_ID` — Show full details for a single webhook. `[--format CHOICE]` |
Webhook reference - potential data exfiltration
| 185 | - `hf webhooks list` — List all webhooks for the current user. `[--format CHOICE]` |
Webhook reference - potential data exfiltration
| 186 | - `hf webhooks update WEBHOOK_ID` — Update an existing webhook. Only provided options are changed. `[--url TEXT --watch TEXT --domain CHOICE --secret TEXT --format CHOICE]` |
External URL reference
| 6 | Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`. |