chore(deps): update huggingface/skills digest to 4948bae by renovate[bot] · Pull Request #689 · stacklok/dockyard

renovate · 2026-07-03T07:58:50Z

This PR contains the following updates:

Package	Update	Change
huggingface/skills	digest	`35810a6` → `4948bae`

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

toolhive-release-app · 2026-07-03T08:06:08Z

🛡️ Skill Security Scan Results

✅ hf-cli

Status: Passed
Findings: 4
Allowed (not blocking): 3
- ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner matched the documented official hf-mount
  installer one-liner (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh,
  SKILL.md:195) - the same official Hugging Face installer URL allowlisted
  above for PIPELINE_TAINT_FLOW / ATR_MCP_MALICIOUS_RESPONSE. Documentation
  prose, no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.
  )
- PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official hf CLI installer (curl -LsSf https://hf.co/cli/install.sh | bash) and the hf-mount installer (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh) as documented install commands. The scanner itself flags both as 'instructional install text in SKILL.md'.)
- PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official hf CLI installer (curl -LsSf https://hf.co/cli/install.sh | bash) and the hf-mount installer (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh) as documented install commands. The scanner itself flags both as 'instructional install text in SKILL.md'.)

✅ hf-mcp

Status: Passed
Findings: 12
Allowed (not blocking): 9
- LLM_COMMAND_INJECTION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): documented first-party HF Hub MCP behavior. SKILL.md shows passing script/shell-command content to the hf_jobs tool, which by design executes user-authored jobs on HF Jobs cloud GPU containers. This execution surface is inherent to the HF MCP server's purpose (running training/compute jobs); it is user-initiated and runs in ephemeral remote containers, not covert injection.)
- LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): SKILL.md documents passing HF_TOKEN as a job secret to hf_jobs so remote jobs can authenticate to the HF Hub. Forwarding the user's own HF credential to HF's own job infrastructure is first-party, user-initiated authentication inherent to the HF MCP server; not covert third-party data exfiltration.)
- LLM_COMMAND_INJECTION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): documented first-party HF Hub MCP behavior. SKILL.md shows passing script/shell-command content to the hf_jobs tool, which by design executes user-authored jobs on HF Jobs cloud GPU containers. This execution surface is inherent to the HF MCP server's purpose (running training/compute jobs); it is user-initiated and runs in ephemeral remote containers, not covert injection.)
- LLM_PROMPT_INJECTION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): the skill fetches HF Hub READMEs/model cards/docs via hub_repo_details(include_readme=true) and hf_doc_fetch. Processing public Hub content is the core purpose of an HF Hub MCP skill; the prompt-injection exposure from untrusted Hub documents is inherent to that first-party, user-initiated browsing surface.)
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
- ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner pattern-matched the fragment && python in an hf_jobs command example in SKILL.md:90 (pip install transformers trl && python train.py); a documented job-command string, not a host command injection. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner pattern-matched the literal $HF_TOKEN token in SKILL.md (lines 92, 172) where it documents passing HF_TOKEN as a job secret to hf_jobs; a documentation example, not an executable env-var exfiltration. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on `inc (the start of include_readme) in an hub_repo_details example in SKILL.md:171; a documented tool parameter, not an executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner pattern-matched the literal $HF_TOKEN token in SKILL.md (lines 92, 172) where it documents passing HF_TOKEN as a job secret to hf_jobs; a documentation example, not an executable env-var exfiltration. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)

✅ huggingface-community-evals

Status: Passed
Findings: 5
Allowed (not blocking): 1
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ huggingface-datasets

Status: Passed
Findings: 16
Allowed (not blocking): 15
- LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): the 'Agent Traces' dataset upload is first-party, user-initiated functionality. The skill reads local agent session dirs (~/.claude/projects, ~/.codex/sessions, ~/.pi/agent/sessions) and uploads JSONL to the user's own HF Datasets repo; the skill itself documents the PII/secret risk and recommends private repos. The same finding also flags HF_TOKEN being set/used in upload CLI commands — standard HF authentication. Not covert third-party exfiltration.)
- LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): the 'Agent Traces' dataset upload is first-party, user-initiated functionality. The skill reads local agent session dirs (~/.claude/projects, ~/.codex/sessions, ~/.pi/agent/sessions) and uploads JSONL to the user's own HF Datasets repo; the skill itself documents the PII/secret risk and recommends private repos. The same finding also flags HF_TOKEN being set/used in upload CLI commands — standard HF authentication. Not covert third-party exfiltration.)
- LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): the 'Agent Traces' dataset upload is first-party, user-initiated functionality. The skill reads local agent session dirs (~/.claude/projects, ~/.codex/sessions, ~/.pi/agent/sessions) and uploads JSONL to the user's own HF Datasets repo; the skill itself documents the PII/secret risk and recommends private repos. The same finding also flags HF_TOKEN being set/used in upload CLI commands — standard HF authentication. Not covert third-party exfiltration.)
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00021 (Allowed: FP: cisco-ai-skill-scanner matched the documentation placeholder export HF_TOKEN=<your_hf_token> in a SKILL.md setup example — a literal placeholder, not a real secret value; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)

✅ huggingface-gradio

Status: Passed
Findings: 4
Allowed (not blocking): 1
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ huggingface-llm-trainer

Status: Passed
Findings: 128
Allowed (not blocking): 73
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00062 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00062 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00004 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00004 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00010 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- ATR_2026_00012 (Allowed: FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
- TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The bundled scripts/convert_to_gguf.py references sudo apt-get install / sudo yum install for optional system packages (build tools) when converting trained models to GGUF format. These run in ephemeral HF Jobs containers, not on the user's host. The script is HF-authored and documented in SKILL.md.)
- TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The bundled scripts/convert_to_gguf.py references sudo apt-get install / sudo yum install for optional system packages (build tools) when converting trained models to GGUF format. These run in ephemeral HF Jobs containers, not on the user's host. The script is HF-authored and documented in SKILL.md.)
- TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The bundled scripts/convert_to_gguf.py references sudo apt-get install / sudo yum install for optional system packages (build tools) when converting trained models to GGUF format. These run in ephemeral HF Jobs containers, not on the user's host. The script is HF-authored and documented in SKILL.md.)
- TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The bundled scripts/convert_to_gguf.py references sudo apt-get install / sudo yum install for optional system packages (build tools) when converting trained models to GGUF format. These run in ephemeral HF Jobs containers, not on the user's host. The script is HF-authored and documented in SKILL.md.)
- TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The bundled scripts/convert_to_gguf.py references sudo apt-get install / sudo yum install for optional system packages (build tools) when converting trained models to GGUF format. These run in ephemeral HF Jobs containers, not on the user's host. The script is HF-authored and documented in SKILL.md.)
- TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The bundled scripts/convert_to_gguf.py references sudo apt-get install / sudo yum install for optional system packages (build tools) when converting trained models to GGUF format. These run in ephemeral HF Jobs containers, not on the user's host. The script is HF-authored and documented in SKILL.md.)
- DATA_EXFIL_NETWORK_REQUESTS (Allowed: Bundled helper scripts (scripts/dataset_inspector.py, scripts/hf_benchmarks.py) use urllib.request to query the public Hugging Face Hub API for dataset validation and benchmark lookups — documented workflow steps required by the skill.)
- DATA_EXFIL_NETWORK_REQUESTS (Allowed: Bundled helper scripts (scripts/dataset_inspector.py, scripts/hf_benchmarks.py) use urllib.request to query the public Hugging Face Hub API for dataset validation and benchmark lookups — documented workflow steps required by the skill.)
- DATA_EXFIL_NETWORK_REQUESTS (Allowed: Bundled helper scripts (scripts/dataset_inspector.py, scripts/hf_benchmarks.py) use urllib.request to query the public Hugging Face Hub API for dataset validation and benchmark lookups — documented workflow steps required by the skill.)

✅ huggingface-paper-publisher

Status: Passed
Findings: 9
Allowed (not blocking): 4
- BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION (Allowed: False positive - same root cause as BEHAVIOR_ENV_VAR_EXFILTRATION
  above. The "crossfile" detection is from paper_manager.py reading
  env vars and triggering its own network helpers within the same file/
  module. All network destinations are huggingface.co or
  export.arxiv.org. Verified at digest
  acd2bf5a7126994e15143bec061fe87a882811f3.
  )
- TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill uses network access through its bundled paper_manager.py script (as its documented workflow), but does not declare an explicit network-access tool in frontmatter. All network calls target the public Hugging Face Hub API documented in the SKILL.md.)
- BEHAVIOR_ENV_VAR_EXFILTRATION (Allowed: False positive - matches scripts/paper_manager.py reading HF_TOKEN
  (line 44) and making requests.get() calls to
  https://huggingface.co/papers/{arxiv_id} (lines 69, 98, 179, 215) and
  https://export.arxiv.org/api/query (line 352, no token sent). This
  is the standard, intended HF API auth pattern — token issued by
  huggingface.co is sent back to huggingface.co. Source domain == sink
  domain. Verified at digest acd2bf5a7126994e15143bec061fe87a882811f3.
  )
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ huggingface-papers

Status: Passed
Findings: 5
Allowed (not blocking): 1
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ huggingface-tool-builder

Status: Passed
Findings: 6
Allowed (not blocking): 2
- TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill uses network access through its bundled reference scripts that call the public Hugging Face Hub API. The frontmatter does not declare a dedicated network-access tool, but the network calls are documented examples bundled for user education, not runtime execution by the skill itself.)
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ huggingface-trackio

Status: Passed
Findings: 5
Allowed (not blocking): 1
- MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

✅ huggingface-vision-trainer

Status: Passed
Findings: 7
Allowed (not blocking): 1
- DATA_EXFIL_NETWORK_REQUESTS (Allowed: The bundled scripts/dataset_inspector.py uses urllib.request.urlopen() to query the public Hugging Face Hub API for dataset format validation — a documented workflow step required before launching GPU training.)

❌ transformers-js

Status: Failed
Findings: 202
Blocking: 138

Blocking issues:

[ATR_2026_00066] (CRITICAL) Pattern detected: `bash (SKILL.md:17)
[ATR_2026_00010] (CRITICAL) Pattern detected: ` when finished to prevent memory leaks. See examples in [Code Examples](./referenc (SKILL.md:47)
[ATR_2026_00012] (HIGH) Pattern detected: | https://huggingface.co/models?pipeline_tag=zero-sh (SKILL.md:277)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (SKILL.md:358)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (SKILL.md:360)
[ATR_2026_00012] (HIGH) Pattern detected: ; // Load from file system (SKILL.md:372)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${HF_TOKEN} (SKILL.md:386)
[ATR_2026_00012] (HIGH) Pattern detected: get_available (SKILL.md:433)
[ATR_2026_00010] (CRITICAL) Pattern detected: @huggingface/tokenizers. It is a separate lightweight package useful when you need fast tokenization/encoding without loading full model inferenc (SKILL.md:442)
[ATR_2026_00066] (CRITICAL) Pattern detected: `bash (SKILL.md:444)
[ATR_2026_00040] (CRITICAL) Pattern detected: exec (SKILL.md:496)
[ATR_2026_00010] (CRITICAL) Pattern detected: ` func (SKILL.md:507)
[ATR_2026_00051] (HIGH) Pattern detected: for each (SKILL.md:512)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (SKILL.md:517)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.status}: ${info.file ?? ''} (SKILL.md:521)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file}: ${info.progress.toFixed(1)} (SKILL.md:525)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file} (SKILL.md:529)
[ATR_2026_00012] (HIGH) Pattern detected: ; // Model id (SKILL.md:544)
[ATR_2026_00066] (CRITICAL) Pattern detected: ' and ' (SKILL.md:546)
[ATR_2026_00040] (CRITICAL) Pattern detected: exec (SKILL.md:566)
[ATR_2026_00010] (CRITICAL) Pattern detected: q8 or q4 for faster inferenc (SKILL.md:576)
[ATR_2026_00012] (HIGH) Pattern detected: max_new_tokens to avoid (SKILL.md:580)
[ATR_2026_00012] (HIGH) Pattern detected: pipe.dispose() when finish (SKILL.md:585)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (SKILL.md:623)
[ATR_2026_00040] (CRITICAL) Pattern detected: deploy (SKILL.md:641)
[ATR_2026_00111] (CRITICAL) Pattern detected: summarization (SKILL.md:658)
[ATR_2026_00012] (HIGH) Pattern detected: | Zero-shot classification | `zero-sh (SKILL.md:662)
[ATR_2026_00012] (HIGH) Pattern detected: | Zero-shot image classification | `zero-sh (SKILL.md:668)
[ATR_2026_00012] (HIGH) Pattern detected: | Zero-shot object detection | `zero-sh (SKILL.md:669)
[ATR_2026_00010] (CRITICAL) Pattern detected: `sentenc (SKILL.md:676)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${percentUsed.toFixed(2)} (references/CACHE.md:92)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${((estimate.quota - estimate.usage) / 1024 / 1024).toFixed(2)} (references/CACHE.md:93)
[ATR_2026_00010] (CRITICAL) Pattern detected: ~/.cache/huggingface/" from performanc (references/CACHE.md:122)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CACHE.md:133)
[ATR_2026_00091] (CRITICAL) Pattern detected: constructor (references/CACHE.md:183)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CACHE.md:256)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CACHE.md:259)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CACHE.md:265)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CACHE.md:268)
[ATR_2026_00004] (CRITICAL) Pattern detected: ### Configuration (references/CACHE.md:272)
[ATR_2026_00051] (HIGH) Pattern detected: Download every (references/CACHE.md:303)
[ATR_2026_00040] (CRITICAL) Pattern detected: deploy (references/CACHE.md:335)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (references/CONFIGURATION.md:3)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (references/CONFIGURATION.md:18)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.fetch (references/CONFIGURATION.md:255)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.fetch (references/CONFIGURATION.md:257)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CONFIGURATION.md:262)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${HF_TOKEN} (references/CONFIGURATION.md:269)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.logLevel (references/CONFIGURATION.md:274)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.logLevel (references/CONFIGURATION.md:276)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (references/CONFIGURATION.md:374)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CONFIGURATION.md:395)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CONFIGURATION.md:396)
[ATR_2026_00161] (CRITICAL) Pattern detected: .env (references/CONFIGURATION.md:397)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${output.data.length} (references/EXAMPLES.md:51)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${Array.from(output.data).slice(0, 5).join(', ')} (references/EXAMPLES.md:52)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/EXAMPLES.md:119)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.status}: ${info.file ?? ''} (references/EXAMPLES.md:123)
[ATR_2026_00051] (HIGH) Pattern detected: for each (references/EXAMPLES.md:126)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file} (references/EXAMPLES.md:131)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress} (references/EXAMPLES.md:141)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${output.data.length} (references/EXAMPLES.md:157)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${documents.length} (references/EXAMPLES.md:209)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${i + 1}/${documents.length} (references/EXAMPLES.md:224)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/EXAMPLES.md:265)
[ATR_2026_00091] (CRITICAL) Pattern detected: \r (references/EXAMPLES.md:265)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${file}: ${progress.toFixed(1)} (references/EXAMPLES.md:274)
[ATR_2026_00091] (CRITICAL) Pattern detected: \n (references/EXAMPLES.md:275)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${progressLines} (references/EXAMPLES.md:277)
[ATR_2026_00091] (CRITICAL) Pattern detected: \r (references/EXAMPLES.md:277)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file} (references/EXAMPLES.md:281)
[ATR_2026_00091] (CRITICAL) Pattern detected: \n (references/EXAMPLES.md:281)
[ATR_2026_00091] (CRITICAL) Pattern detected: \n (references/EXAMPLES.md:285)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${text} (references/EXAMPLES.md:294)
[ATR_2026_00091] (CRITICAL) Pattern detected: \n (references/EXAMPLES.md:294)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${output.data.length} (references/EXAMPLES.md:295)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${Array.from(output.data).slice(0, 5).join(', ')} (references/EXAMPLES.md:296)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/EXAMPLES.md:406)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.status}: ${info.file ?? ''} (references/EXAMPLES.md:410)
[ATR_2026_00066] (CRITICAL) Pattern detected: {{ margin: '10px 0' }} (references/EXAMPLES.md:454)
[ATR_2026_00066] (CRITICAL) Pattern detected: {{ fontSize: '12px', marginBottom: '5px' }} (references/EXAMPLES.md:455)
[ATR_2026_00066] (CRITICAL) Pattern detected: {{ width: '100%', height: '20px', background: '#f0f0f0', borderRadius: '5px', overflow: 'hidden' }} (references/EXAMPLES.md:456)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${progress} (references/EXAMPLES.md:459)
[ATR_2026_00013] (CRITICAL) Pattern detected: http://localhost:3000 (references/EXAMPLES.md:542)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${signal} (references/EXAMPLES.md:591)
[ATR_2026_00091] (CRITICAL) Pattern detected: \n (references/EXAMPLES.md:591)
[ATR_2026_00013] (CRITICAL) Pattern detected: http://localhost:3000 (references/EXAMPLES.md:613)
[ATR_2026_00063] (CRITICAL) Pattern detected: Compress (references/MODEL_ARCHITECTURES.md:23)
[ATR_2026_00012] (HIGH) Pattern detected: get_available (references/MODEL_REGISTRY.md:80)
[ATR_2026_00012] (HIGH) Pattern detected: get_available (references/MODEL_REGISTRY.md:85)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/MODEL_REGISTRY.md:125)
[ATR_2026_00012] (HIGH) Pattern detected: get_available (references/MODEL_REGISTRY.md:143)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.allowRemoteModels = false (references/MODEL_REGISTRY.md:190)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (references/MODEL_REGISTRY.md:195)
[ATR_2026_00010] (CRITICAL) Pattern detected: ` func (references/PIPELINE_OPTIONS.md:3)
[ATR_2026_00010] (CRITICAL) Pattern detected: ` func (references/PIPELINE_OPTIONS.md:15)
[ATR_2026_00040] (CRITICAL) Pattern detected: exec (references/PIPELINE_OPTIONS.md:27)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/PIPELINE_OPTIONS.md:73)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file}: ${info.progress.toFixed(1)} (references/PIPELINE_OPTIONS.md:80)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file} (references/PIPELINE_OPTIONS.md:84)
[ATR_2026_00012] (HIGH) Pattern detected: ; // Model id (references/PIPELINE_OPTIONS.md:95)
[ATR_2026_00066] (CRITICAL) Pattern detected: ' and ' (references/PIPELINE_OPTIONS.md:97)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/PIPELINE_OPTIONS.md:113)
[ATR_2026_00051] (HIGH) Pattern detected: for each (references/PIPELINE_OPTIONS.md:118)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file} (references/PIPELINE_OPTIONS.md:122)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress} (references/PIPELINE_OPTIONS.md:132)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.file}: ${mb}/${totalMb} (references/PIPELINE_OPTIONS.md:136)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.cacheDir (references/PIPELINE_OPTIONS.md:183)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.useFSCache = true (references/PIPELINE_OPTIONS.md:184)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.cacheKey (references/PIPELINE_OPTIONS.md:185)
[ATR_2026_00040] (CRITICAL) Pattern detected: deploy (references/PIPELINE_OPTIONS.md:203)
[ATR_2026_00111] (CRITICAL) Pattern detected: env.allowLocalModels = true (references/PIPELINE_OPTIONS.md:208)
[ATR_2026_00010] (CRITICAL) Pattern detected: 'q8' - 8-bit quantized (good balanc (references/PIPELINE_OPTIONS.md:360)
[ATR_2026_00063] (CRITICAL) Pattern detected: compress (references/PIPELINE_OPTIONS.md:361)
[ATR_2026_00010] (CRITICAL) Pattern detected: fp16 | Medium | Medium | High | Production, GPU inferenc (references/PIPELINE_OPTIONS.md:383)
[ATR_2026_00010] (CRITICAL) Pattern detected: q8 | Small | Fast | Good | Production, CPU inferenc (references/PIPELINE_OPTIONS.md:384)
[ATR_2026_00040] (CRITICAL) Pattern detected: exec (references/PIPELINE_OPTIONS.md:437)
[ATR_2026_00040] (CRITICAL) Pattern detected: exec (references/PIPELINE_OPTIONS.md:441)
[ATR_2026_00111] (CRITICAL) Pattern detected: executionProviders (references/PIPELINE_OPTIONS.md:452)
[ATR_2026_00111] (CRITICAL) Pattern detected: executionMode (references/PIPELINE_OPTIONS.md:456)
[ATR_2026_00084] (HIGH) Pattern detected: | Override dynamic dimensions (e.g., { batch_size: 1 }) | - | (references/PIPELINE_OPTIONS.md:458)
[ATR_2026_00040] (CRITICAL) Pattern detected: exec (references/PIPELINE_OPTIONS.md:462)
[ATR_2026_00066] (CRITICAL) Pattern detected: ${info.progress.toFixed(1)} (references/PIPELINE_OPTIONS.md:480)
[ATR_2026_00111] (CRITICAL) Pattern detected: env (references/PIPELINE_OPTIONS.md:541)
[ATR_2026_00012] (HIGH) Pattern detected: progress_callback for large models to sh (references/PIPELINE_OPTIONS.md:548)
[ATR_2026_00010] (CRITICAL) Pattern detected: q8 or q4 for CPU inferenc (references/PIPELINE_OPTIONS.md:549)
[ATR_2026_00010] (CRITICAL) Pattern detected: webgpu for better performanc (references/PIPELINE_OPTIONS.md:550)
[ATR_2026_00012] (HIGH) Pattern detected: local_files_only: true in production to avoid (references/PIPELINE_OPTIONS.md:551)
[ATR_2026_00040] (CRITICAL) Pattern detected: deploy (references/PIPELINE_OPTIONS.md:552)
[ATR_2026_00010] (CRITICAL) Pattern detected: ` func (references/PIPELINE_OPTIONS.md:557)
[ATR_2026_00004] (CRITICAL) Pattern detected: { role: ' (references/TEXT_GENERATION.md:188)
[ATR_2026_00030] (CRITICAL) Pattern detected: role: 'system' (references/TEXT_GENERATION.md:188)
[ATR_2026_00004] (CRITICAL) Pattern detected: { role: ' (references/TEXT_GENERATION.md:189)
[ATR_2026_00004] (CRITICAL) Pattern detected: { role: ' (references/TEXT_GENERATION.md:204)
[ATR_2026_00030] (CRITICAL) Pattern detected: role: 'system' (references/TEXT_GENERATION.md:204)
[ATR_2026_00004] (CRITICAL) Pattern detected: { role: ' (references/TEXT_GENERATION.md:205)
[ATR_2026_00004] (CRITICAL) Pattern detected: { role: ' (references/TEXT_GENERATION.md:206)
[ATR_2026_00004] (CRITICAL) Pattern detected: { role: ' (references/TEXT_GENERATION.md:207)

Summary: Scanned 12 skill(s), found 138 blocking issue(s).

⚠️ Action Required: Review the blocking findings. Add a justified entry to the skill's security.allowed_issues[] in its spec.yaml if the finding is a false positive.

…ity-evals,huggingface-datasets,huggingface-gradio,huggingface-llm-trainer,huggingface-paper-publisher,huggingface-papers,huggingface-tool-builder,huggingface-trackio,huggingface-vision-trainer,transformers-js

renovate · 2026-07-03T11:25:33Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

renovate Bot added the dependencies label Jul 3, 2026

chore(deps): update huggingface/skills digest to 4948bae

901f46d

renovate Bot changed the title ~~chore(deps): update huggingface/skills digest to 35e8c35~~ chore(deps): update huggingface/skills digest to 4948bae Jul 3, 2026

renovate Bot force-pushed the renovate/huggingface-skills-digest branch from 9026e2b to 901f46d Compare July 3, 2026 10:17

chore(skills): bump spec.version for hf-cli,hf-mcp,huggingface-commun…

53270ac

…ity-evals,huggingface-datasets,huggingface-gradio,huggingface-llm-trainer,huggingface-paper-publisher,huggingface-papers,huggingface-tool-builder,huggingface-trackio,huggingface-vision-trainer,transformers-js

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update huggingface/skills digest to 4948bae#689

chore(deps): update huggingface/skills digest to 4948bae#689
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/huggingface-skills-digest

renovate Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

toolhive-release-app Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Uh oh!

toolhive-release-app Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Skill Security Scan Results

✅ hf-cli

✅ hf-mcp

✅ huggingface-community-evals

✅ huggingface-datasets

✅ huggingface-gradio

✅ huggingface-llm-trainer

✅ huggingface-paper-publisher

✅ huggingface-papers

✅ huggingface-tool-builder

✅ huggingface-trackio

✅ huggingface-vision-trainer

❌ transformers-js

Uh oh!

renovate Bot commented Jul 3, 2026

Edited/Blocked Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 3, 2026 •

edited

Loading

toolhive-release-app Bot commented Jul 3, 2026 •

edited

Loading