hf-download — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hf-download (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill requires Python 3.8+ and standard library only. No external packages needed.
To install this skill's dependencies:
pip-compile ./requirements.in
pip install -r ./requirements.txtSee ./requirements.txt for the dependency lockfile (currently empty — standard library only).
Status: Active Author: Richard Fremmerlid Domain: HuggingFace Integration Depends on: hf-init (credentials must be configured first)
Provides consolidated download operations for all HF-consuming plugins (Primary Agent, local-llm-bench, etc.) to fetch files, models, and snapshots. All downloads include exponential backoff for rate-limit handling.
| Function | Description | Source Repo |
|---|---|---|
download_file() | Download a single file | Custom or default repo |
download_folder() | Download an entire folder snapshot | Custom or default repo |
from hf_download import download_file, download_folder
from pathlib import Path
# Download a single file from dataset repository to local directory
local_file_path = await download_file(
filename="data/soul_traces.jsonl",
local_dir=Path("./local_data")
)
# Download a model snapshot (e.g. GGUF weights)
model_dir = await download_folder(
local_dir=Path("./models"),
repo_id="unsloth/gemma-4-12b-it-GGUF",
repo_type="model",
allow_patterns=["*UD-Q4_K_XL.gguf"]
)# Download a single file
python ./hf_download.py --filename data/soul_traces.jsonl --local-dir ./local_data
# Download a specific model snapshot using glob patterns
python ./hf_download.py \
--repo-id unsloth/gemma-4-12b-it-GGUF \
--repo-type model \
--allow-patterns "*UD-Q4_K_XL.gguf" \
--local-dir ./modelshf-init first to validate credentials and dataset structure.huggingface_hub installed (pip install huggingface_hub).HUGGING_FACE_USERNAME, HUGGING_FACE_TOKEN.All operations return paths on success or raise appropriate exceptions with exponential backoff retries (up to 5 attempts) on rate limits or API connectivity issues.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.