huggingface-hub — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited huggingface-hub (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
hf) Reference GuideThe hf command is the modern command-line interface for interacting with the Hugging Face Hub, providing tools to manage repositories, models, datasets, and Spaces.
IMPORTANT: Thehfcommand replaces the now deprecatedhuggingface-clicommand.
curl -LsSf https://hf.co/cli/install.sh | bash -shf --help to view all available functions and real-world examples.HF_TOKEN environment variable or the --token flag.hf download REPO_ID: Download files from the Hub.hf upload REPO_ID: Upload files/folders (recommended for single-commit).hf upload-large-folder REPO_ID LOCAL_PATH: Recommended for resumable uploads of large directories.hf sync: Sync files between a local directory and a bucket.hf env / hf version: View environment and version details.hf auth)login / logout: Manage sessions using tokens from huggingface.co/settings/tokens.list / switch: Manage and toggle between multiple stored access tokens.whoami: Identify the currently logged-in account.hf repos)create / delete: Create or permanently remove repositories.duplicate: Clone a model, dataset, or Space to a new ID.move: Transfer a repository between namespaces.branch / tag: Manage Git-like references.delete-files: Remove specific files using patterns.hf datasets list, info, and parquet (list parquet URLs).hf datasets sql SQL — Execute raw SQL via DuckDB against dataset parquet URLs.hf models list and info.hf papers list — View daily papers.hf discussions)list, create, info, comment, close, reopen, and rename.diff: View changes in a PR.merge: Finalize pull requests.deploy, pause, resume, scale-to-zero, catalog).hf jobs uv for running Python scripts with inline dependencies and stats for resource monitoring.dev-mode and hot-reload for Python files without full restarts.create, cp, mv, rm, sync).list, prune (remove detached revisions), and verify (checksum checks).create, watch, enable/disable).add-item, update, list).--format json: Produces machine-readable output for automation.-q / --quiet: Limits output to IDs only.hf extensions install REPO_ID.hf skills add.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.