huggingface-skills

Why this score

Popularity score: 90/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

Security

Scanned Oct 22, 2026 at commit c3ff942be3e0, with Cisco's open-source skill-scanner.

What its code does:

• Reads environment variables and sends network requests with them API clients do this to send your key to the service. Check which service it talks to.apps/evals-leaderboard/collect_evals.py, apps/hackers-leaderboard/collect_points.py, skills/huggingface-llm-trainer/scripts/hf_benchmarks.py and 6 more
• Runs shell commands Common for dev tools. Read the commands it runs.apps/quests/README.md:2, skills/hf-cli/SKILL.md:1, skills/hf-cloud-python-env-setup/scripts/setup_env.py:68 and 15 more
• Makes network requestsapps/evals-leaderboard/app.py:52, apps/hackers-leaderboard/app.py:46, skills/huggingface-llm-trainer/scripts/dataset_inspector.py:43 and 10 more
• Installs system packagesskills/huggingface-llm-trainer/scripts/convert_to_gguf.py:27 and 5 more
• Uses dependencies without a pinned version A later version of a dependency could change what runs.apps/evals-leaderboard/requirements.txt:1, apps/hackers-leaderboard/requirements.txt:1, skills/hf-cloud-python-env-setup/requirements.txt:16 and 6 more
• Includes scripts in hidden folders Folders starting with a dot are easy to miss when you read a repo..claude-plugin/marketplace-internal.json, .cursor-plugin/plugin.json, .mcp.json

Web addresses in its code:

• huggingface.coapps/evals-leaderboard/app.py:35
• datasets-server.huggingface.coskills/huggingface-datasets/SKILL.md:44
• arxiv.orgskills/huggingface-paper-publisher/scripts/paper_manager.py:107
• raw.githubusercontent.comscripts/build_skills_index.py:195
• gradio.appskills/huggingface-lora-space-builder/SKILL.md:145
• hf.coskills/hf-cli/SKILL.md:6
• api.github.comskills/hf-cloud-serving-image-selection/SKILL.md:189
• docs.astral.shskills/hf-cloud-python-env-setup/scripts/setup_env.py:88
• export.arxiv.orgskills/huggingface-paper-publisher/scripts/paper_manager.py:352

These are the sites named in the code, so it's where your data could go. It isn't a complete list: code can build addresses while it runs, and a few of these may be links rather than calls. Whatever you send also goes to the AI model you use.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.