hugging-face-cli
Facilitates Hugging Face Hub operations via CLI for managing models, datasets, and repositories efficiently.
Install this skill
or
44/100
Security score
The hugging-face-cli skill was audited on May 12, 2026 and we found 10 security issues across 2 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
high line 9
Curl to non-GitHub URL
SourceSKILL.md
| 9 | `curl -LsSf https://hf.co/cli/install.sh -o /tmp/hf-install.sh && less /tmp/hf-install.sh && bash /tmp/hf-install.sh` |
medium line 162
Webhook reference - potential data exfiltration
SourceSKILL.md
| 162 | ### `hf webhooks` — Manage webhooks on the Hub. |
medium line 164
Webhook reference - potential data exfiltration
SourceSKILL.md
| 164 | - `hf webhooks create --watch TEXT` — Create a new webhook. `[--url TEXT --job-id TEXT --domain CHOICE --secret TEXT]` |
medium line 165
Webhook reference - potential data exfiltration
SourceSKILL.md
| 165 | - `hf webhooks delete WEBHOOK_ID` — Delete a webhook permanently. `[--yes]` |
medium line 166
Webhook reference - potential data exfiltration
SourceSKILL.md
| 166 | - `hf webhooks disable WEBHOOK_ID` — Disable an active webhook. |
medium line 167
Webhook reference - potential data exfiltration
SourceSKILL.md
| 167 | - `hf webhooks enable WEBHOOK_ID` — Enable a disabled webhook. |
medium line 168
Webhook reference - potential data exfiltration
SourceSKILL.md
| 168 | - `hf webhooks info WEBHOOK_ID` — Show full details for a single webhook as JSON. |
medium line 169
Webhook reference - potential data exfiltration
SourceSKILL.md
| 169 | - `hf webhooks list` — List all webhooks for the current user. `[--format CHOICE --quiet]` |
medium line 170
Webhook reference - potential data exfiltration
SourceSKILL.md
| 170 | - `hf webhooks update WEBHOOK_ID` — Update an existing webhook. Only provided options are changed. `[--url TEXT --watch TEXT --domain CHOICE --secret TEXT]` |
low line 9
External URL reference
SourceSKILL.md
| 9 | `curl -LsSf https://hf.co/cli/install.sh -o /tmp/hf-install.sh && less /tmp/hf-install.sh && bash /tmp/hf-install.sh` |
Scanned on May 12, 2026
View Security Dashboard