AI Skill Shield scan report: huggingface/skills (26 skills)

## AI Skill Shield scan updated [](https://ai-skill-shield.suppeng.com/trust/github/huggingface/skills) | Field | Result | | --- | --- | | Commit | `cead19e10754` | | Score | **88/100** | | Status | ⚠️ Review recommended | | Findings | 4 critical · 7 high · 53 medium · 34 low | | Scanned | 2026-08-30 | [View the full AI Skill Shield report](https://ai-skill-shield.suppeng.com/trust/github/huggingface/skills) Findings summary ### Critical — Pipe-to-shell download and execute **Location:** `skills/hf-cli/SKILL.md:6` Piping curl output directly to shell executes untrusted code. This is a major supply chain risk. **Recommendation:** Download and verify scripts before execution. Never pipe directly to shell. ### Critical — Download and execute (chained) **Location:** `skills/hf-cli/SKILL.md:6` Chained download and execute command. Classic staged malware. **Recommendation:** Do not chain download commands with execution. Review each step independently. ### Critical — SS-SHELL-002 **Location:** `skills/hf-cli/SKILL.md:6` Remote script execution via curl pipe to shell ### Critical — AWS credential access **Location:** `skills/hf-cloud-aws-context-discovery/SKILL.md:16` Reading AWS credentials files exposes cloud infrastructure access. **Recommendation:** Use AWS SDK with IAM roles. Never read credential files directly. ### High — curl to external host **Location:** `skills/hf-cli/SKILL.md:6` curl to external hosts can download/upload arbitrary data. **Recommendation:** Whitelist allowed curl targets. Block arbitrary external curl calls. ### High — curl to external host **Location:** `skills/hf-cloud-serving-image-selection/SKILL.md:65` curl to external hosts can download/upload arbitrary data. **Recommendation:** Whitelist allowed curl targets. Block arbitrary external curl calls. ### High — Missing required field: name **Location:** `skills/huggingface-datasets/SKILL.md:1` Frontmatter is missing the required "name" field **Recommendation:** Add "name" to the frontmatter section ### High — Missing required field: description **Location:** `skills/huggingface-datasets/SKILL.md:1` Frontmatter is missing the required "description" field **Recommendation:** Add "description" to the frontmatter section ### High — curl to external host **Location:** `skills/huggingface-datasets/SKILL.md:44` curl to external hosts can download/upload arbitrary data. **Recommendation:** Whitelist allowed curl targets. Block arbitrary external curl calls. ### High — curl to external host **Location:** `skills/huggingface-papers/SKILL.md:46` curl to external hosts can download/upload arbitrary data. **Recommendation:** Whitelist allowed curl targets. Block arbitrary external curl calls. ### High — curl to external host **Location:** `skills/huggingface-tool-builder/SKILL.md:72` curl to external hosts can download/upload arbitrary data. **Recommendation:** Whitelist allowed curl targets. Block arbitrary external curl calls. ### Medium — ping to external host **Location:** `hf-mcp/skills/hf-mcp/SKILL.md:8` Ping to external hosts can be used for network reconnaissance. **Recommendation:** Block ping to external hosts. It is rarely needed legitimately. _Showing the 12 highest-priority findings. View the full report for 166 more._ Add this status badge to the README [](https://ai-skill-shield.suppeng.com/trust/github/huggingface/skills) Copy this Markdown into the README: ```md [](https://ai-skill-shield.suppeng.com/trust/github/huggingface/skills) ``` --- _This issue is maintained automatically after new default-branch scans. Automated scan results are evidence for review, not a guarantee of safety._