hugging-face-jobs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hugging-face-jobs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run any workload on fully managed Hugging Face infrastructure. No local setup required—jobs run on cloud CPUs, GPUs, or TPUs and can persist results to the Hugging Face Hub.
Common use cases:
model-trainer skill for TRL-specific training)For model training specifically: See the model-trainer skill for TRL-based training workflows.
Use this skill when users want to:
When assisting with jobs:
hf_jobs("uv", {...}) or hf_jobs("run", {...}). The script parameter accepts Python code directly. Do NOT save to local files unless the user explicitly requests it. Pass the script content as a string to hf_jobs().HF_TOKEN via secrets. See Token Usage section below.Before starting any job, verify:
hf_whoami()When tokens are required:
How to provide tokens:
# hf_jobs MCP tool — $HF_TOKEN is auto-replaced with real token:
{"secrets": {"HF_TOKEN": "$HF_TOKEN"}}
# HfApi().run_uv_job() — MUST pass actual token:
from huggingface_hub import get_token
secrets={"HF_TOKEN": get_token()}⚠️ CRITICAL: The $HF_TOKEN placeholder is ONLY auto-replaced by the hf_jobs MCP tool. When using HfApi().run_uv_job(), you MUST pass the real token via get_token(). Passing the literal string "$HF_TOKEN" results in a 9-character invalid token and 401 errors.
What are HF Tokens?
hf auth loginToken Types:
Always Required:
Not Required:
#### Method 1: Automatic Token (Recommended)
hf_jobs("uv", {
"script": "your_script.py",
"secrets": {"HF_TOKEN": "$HF_TOKEN"} # ✅ Automatic replacement
})How it works:
$HF_TOKEN is a placeholder that gets replaced with your actual tokenhf auth login)Benefits:
#### Method 2: Explicit Token (Not Recommended)
hf_jobs("uv", {
"script": "your_script.py",
"secrets": {"HF_TOKEN": "hf_abc123..."} # ⚠️ Hardcoded token
})When to use:
Security concerns:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.