chore(deps): update huggingface/skills digest to abc20ae

[renovate]

This PR contains the following updates:

Package	Update	Change
huggingface/skills	digest	ec01082 → abc20ae

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ hf-cli

• Status: Passed
• Findings: 3
• Allowed (not blocking): 2
  • ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner matched the documented official hf-mount
    installer one-liner (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh,
    SKILL.md:195) - the same official Hugging Face installer URL allowlisted
    above for PIPELINE_TAINT_FLOW / ATR_MCP_MALICIOUS_RESPONSE. Documentation
    prose, no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.
    )
  • PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official hf CLI installer (curl -LsSf https://hf.co/cli/install.sh | bash) and the hf-mount installer (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh) as documented install commands. The scanner itself flags both as 'instructional install text in SKILL.md'.)

✅ hf-mcp

• Status: Passed
• Findings: 2
• Allowed (not blocking): 2
  • LLM_SUPPLY_CHAIN_ATTACK (Allowed: Risk accepted by maintainer (danbarr, 2026-09-18): the documented training example installs the Hugging Face-maintained transformers and trl packages at runtime in a user-initiated, ephemeral HF Jobs container. Jobs needing private-repository access explicitly receive an HF token, so mutable package dependencies in that environment carry supply-chain exposure; this is accepted as part of the skill's first-party remote-compute workflow.)
  • LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): SKILL.md documents passing HF_TOKEN as a job secret to hf_jobs so remote jobs can authenticate to the HF Hub. Forwarding the user's own HF credential to HF's own job infrastructure is first-party, user-initiated authentication inherent to the HF MCP server; not covert third-party data exfiltration.)

✅ huggingface-datasets

• Status: Passed
• Findings: 8
• Allowed (not blocking): 5
  • LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): the 'Agent Traces' dataset upload is first-party, user-initiated functionality. The skill reads local agent session dirs (~/.claude/projects, ~/.codex/sessions, ~/.pi/agent/sessions) and uploads JSONL to the user's own HF Datasets repo; the skill itself documents the PII/secret risk and recommends private repos. The same finding also flags HF_TOKEN being set/used in upload CLI commands — standard HF authentication. Not covert third-party exfiltration.)
  • MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
  • ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
  • ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)

✅ huggingface-gradio

• Status: Passed
• Findings: 1

✅ huggingface-paper-publisher

• Status: Passed
• Findings: 3
• Allowed (not blocking): 3
  • TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill uses network access through its bundled paper_manager.py script (as its documented workflow), but does not declare an explicit network-access tool in frontmatter. All network calls target the public Hugging Face Hub API documented in the SKILL.md.)
  • LLM_SUPPLY_CHAIN_ATTACK (Allowed: SKILL.md documents its bundled script's Python dependencies with minimum-version (>=) constraints (huggingface_hub, pyyaml, requests, markdown, python-dotenv) in an informational 'Dependencies' list read by a human setting up the script locally; Dockyard does not execute or resolve this list at packaging or run time, so it isn't an exploitable install path here. Accepted as inherent to how this vendored skill documents its own script's requirements.)
  • LLM_UNAUTHORIZED_TOOL_USE (Allowed: Accepted risk, not a false positive - the skill's link command
    genuinely does write metadata/citations directly to the
    user-specified Hugging Face repo by default (the --create-pr flag,
    which routes changes through a PR instead, is optional rather than
    default). This is real, intended behavior: the user supplies their
    own write-scoped HF_TOKEN and explicitly names the target repo-id,
    so it operates only on repos the user already controls and named,
    not an arbitrary or attacker-chosen target. Accepted as inherent to
    a first-party HF metadata-publishing tool rather than disputed as
    inapplicable.
    )

✅ huggingface-tool-builder

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill uses network access through its bundled reference scripts that call the public Hugging Face Hub API. The frontmatter does not declare a dedicated network-access tool, but the network calls are documented examples bundled for user education, not runtime execution by the skill itself.)

✅ huggingface-trackio

• Status: Passed
• Findings: 2

✅ transformers-js

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • ATR_2026_00066 (Allowed: FP: cisco-ai-skill-scanner matched JS template-literal interpolations (e.g. ${HF_TOKEN}, ${info.progress.toFixed(1)}, ${info.status}) and markdown code-fence language tags (`bash) throughout SKILL.md; standard Transformers.js example code and doc formatting, no executable threat.)

---

Summary: Completed 8 of 8 skill scan(s), all passed security checks. ✅

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

Security triage: no new exclusions added; all 8 findings remain blocking.

• huggingface-community-evals / LLM_COMMAND_INJECTION: optional --trust-remote-code paths execute model-repository code locally without requiring a trusted, revision-pinned source or isolation.
• huggingface-llm-trainer / LLM_SUPPLY_CHAIN_ATTACK (CRITICAL) and LLM_COMMAND_INJECTION: convert_to_gguf.py enables trust_remote_code=True for environment-selected model IDs in a token-bearing job.
• huggingface-llm-trainer / LLM_SUPPLY_CHAIN_ATTACK (HIGH): directs execution of mutable raw-main remote scripts.
• huggingface-llm-trainer / both META_DETECTED findings: independently identify the same unmitigated remote-code and mutable-upstream execution paths; publisher trust does not remove the risk for user-selected or future mutable content.
• huggingface-papers / LLM_COMMAND_INJECTION: user-derived IDs are substituted into shell command templates, and the skill does not require validation before execution. Its documented arXiv-ID pattern is not applied as a command-execution control.
• huggingface-vision-trainer / LLM_SUPPLY_CHAIN_ATTACK: arbitrary Hub sources, mutable main revisions, and trust_remote_code can execute repository code in the training job.

Validated the four affected specs with build/dockhand validate-skill at abc20ae526d8b4c0e4dff89f904adce28a4a0eb6 (all passed).

[danbarr]

Follow-up: I trialed deferring the four initially flagged updates (huggingface-community-evals, huggingface-llm-trainer, huggingface-papers, and huggingface-vision-trainer). The remaining set still has ten critical ATR_2026_00063 findings in hf-cli, so I did not push the partial revert or add exclusions.

[danbarr]

Correction: deferred the huggingface-community-evals, huggingface-llm-trainer, huggingface-papers, and huggingface-vision-trainer updates. Final status depends on the authoritative GitHub Trusted Skill Scan.