From 532af99e152ab28321ae764a9df2f62a691f4f6c Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 18 Sep 2026 13:37:46 +0000 Subject: [PATCH 1/5] chore(deps): update huggingface/skills digest to abc20ae --- skills/hf-cli/spec.yaml | 2 +- skills/hf-mcp/spec.yaml | 2 +- skills/huggingface-community-evals/spec.yaml | 2 +- skills/huggingface-datasets/spec.yaml | 2 +- skills/huggingface-gradio/spec.yaml | 2 +- skills/huggingface-llm-trainer/spec.yaml | 2 +- skills/huggingface-paper-publisher/spec.yaml | 2 +- skills/huggingface-papers/spec.yaml | 2 +- skills/huggingface-tool-builder/spec.yaml | 2 +- skills/huggingface-trackio/spec.yaml | 2 +- skills/huggingface-vision-trainer/spec.yaml | 2 +- skills/transformers-js/spec.yaml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/skills/hf-cli/spec.yaml b/skills/hf-cli/spec.yaml index 5547c691..1289b504 100644 --- a/skills/hf-cli/spec.yaml +++ b/skills/hf-cli/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/hf-cli" version: "0.3.0" diff --git a/skills/hf-mcp/spec.yaml b/skills/hf-mcp/spec.yaml index 09e6f6a7..c1491fac 100644 --- a/skills/hf-mcp/spec.yaml +++ b/skills/hf-mcp/spec.yaml @@ -11,7 +11,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "hf-mcp/skills/hf-mcp" version: "0.3.0" diff --git a/skills/huggingface-community-evals/spec.yaml b/skills/huggingface-community-evals/spec.yaml index 5b192bb7..b725155c 100644 --- a/skills/huggingface-community-evals/spec.yaml +++ b/skills/huggingface-community-evals/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-community-evals" version: "0.3.0" diff --git a/skills/huggingface-datasets/spec.yaml b/skills/huggingface-datasets/spec.yaml index a1b9cc09..e3001b99 100644 --- a/skills/huggingface-datasets/spec.yaml +++ b/skills/huggingface-datasets/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-datasets" version: "0.3.0" diff --git a/skills/huggingface-gradio/spec.yaml b/skills/huggingface-gradio/spec.yaml index 0362d39d..308bbcf1 100644 --- a/skills/huggingface-gradio/spec.yaml +++ b/skills/huggingface-gradio/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-gradio" version: "0.3.0" diff --git a/skills/huggingface-llm-trainer/spec.yaml b/skills/huggingface-llm-trainer/spec.yaml index 8d38c646..51a974a2 100644 --- a/skills/huggingface-llm-trainer/spec.yaml +++ b/skills/huggingface-llm-trainer/spec.yaml @@ -12,7 +12,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-llm-trainer" version: "0.3.0" diff --git a/skills/huggingface-paper-publisher/spec.yaml b/skills/huggingface-paper-publisher/spec.yaml index 306470da..8cb431a6 100644 --- a/skills/huggingface-paper-publisher/spec.yaml +++ b/skills/huggingface-paper-publisher/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-paper-publisher" version: "0.3.0" diff --git a/skills/huggingface-papers/spec.yaml b/skills/huggingface-papers/spec.yaml index 8729aad0..c4b81807 100644 --- a/skills/huggingface-papers/spec.yaml +++ b/skills/huggingface-papers/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-papers" version: "0.3.0" diff --git a/skills/huggingface-tool-builder/spec.yaml b/skills/huggingface-tool-builder/spec.yaml index d83d4cee..123e2808 100644 --- a/skills/huggingface-tool-builder/spec.yaml +++ b/skills/huggingface-tool-builder/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-tool-builder" version: "0.3.0" diff --git a/skills/huggingface-trackio/spec.yaml b/skills/huggingface-trackio/spec.yaml index 2bdeadef..7f162e31 100644 --- a/skills/huggingface-trackio/spec.yaml +++ b/skills/huggingface-trackio/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-trackio" version: "0.3.0" diff --git a/skills/huggingface-vision-trainer/spec.yaml b/skills/huggingface-vision-trainer/spec.yaml index 8e400906..32893de7 100644 --- a/skills/huggingface-vision-trainer/spec.yaml +++ b/skills/huggingface-vision-trainer/spec.yaml @@ -11,7 +11,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-vision-trainer" version: "0.3.0" diff --git a/skills/transformers-js/spec.yaml b/skills/transformers-js/spec.yaml index fc395d37..849d9d7e 100644 --- a/skills/transformers-js/spec.yaml +++ b/skills/transformers-js/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 + ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/transformers-js" version: "0.3.0" From 6e545a373ef81bd5753917a73228eeaefb9047c6 Mon Sep 17 00:00:00 2001 From: "toolhive-release-app[bot]" <280093410+toolhive-release-app[bot]@users.noreply.github.com> Date: Fri, 18 Sep 2026 13:38:31 +0000 Subject: [PATCH 2/5] chore(skills): bump spec.version for hf-cli,hf-mcp,huggingface-community-evals,huggingface-datasets,huggingface-gradio,huggingface-llm-trainer,huggingface-paper-publisher,huggingface-papers,huggingface-tool-builder,huggingface-trackio,huggingface-vision-trainer,transformers-js --- skills/hf-cli/spec.yaml | 2 +- skills/hf-mcp/spec.yaml | 2 +- skills/huggingface-community-evals/spec.yaml | 2 +- skills/huggingface-datasets/spec.yaml | 2 +- skills/huggingface-gradio/spec.yaml | 2 +- skills/huggingface-llm-trainer/spec.yaml | 2 +- skills/huggingface-paper-publisher/spec.yaml | 2 +- skills/huggingface-papers/spec.yaml | 2 +- skills/huggingface-tool-builder/spec.yaml | 2 +- skills/huggingface-trackio/spec.yaml | 2 +- skills/huggingface-vision-trainer/spec.yaml | 2 +- skills/transformers-js/spec.yaml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/skills/hf-cli/spec.yaml b/skills/hf-cli/spec.yaml index 1289b504..7b4a7c6b 100644 --- a/skills/hf-cli/spec.yaml +++ b/skills/hf-cli/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/hf-cli" - version: "0.3.0" + version: "0.4.0" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/hf-mcp/spec.yaml b/skills/hf-mcp/spec.yaml index c1491fac..79d8e5b7 100644 --- a/skills/hf-mcp/spec.yaml +++ b/skills/hf-mcp/spec.yaml @@ -13,7 +13,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "hf-mcp/skills/hf-mcp" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-community-evals/spec.yaml b/skills/huggingface-community-evals/spec.yaml index b725155c..3eba70fe 100644 --- a/skills/huggingface-community-evals/spec.yaml +++ b/skills/huggingface-community-evals/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-community-evals" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-datasets/spec.yaml b/skills/huggingface-datasets/spec.yaml index e3001b99..ccd0d168 100644 --- a/skills/huggingface-datasets/spec.yaml +++ b/skills/huggingface-datasets/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-datasets" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-gradio/spec.yaml b/skills/huggingface-gradio/spec.yaml index 308bbcf1..e9ae66a0 100644 --- a/skills/huggingface-gradio/spec.yaml +++ b/skills/huggingface-gradio/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-gradio" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-llm-trainer/spec.yaml b/skills/huggingface-llm-trainer/spec.yaml index 51a974a2..ddfa538a 100644 --- a/skills/huggingface-llm-trainer/spec.yaml +++ b/skills/huggingface-llm-trainer/spec.yaml @@ -14,7 +14,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-llm-trainer" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-paper-publisher/spec.yaml b/skills/huggingface-paper-publisher/spec.yaml index 8cb431a6..4e71b576 100644 --- a/skills/huggingface-paper-publisher/spec.yaml +++ b/skills/huggingface-paper-publisher/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-paper-publisher" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-papers/spec.yaml b/skills/huggingface-papers/spec.yaml index c4b81807..e6a332c4 100644 --- a/skills/huggingface-papers/spec.yaml +++ b/skills/huggingface-papers/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-papers" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-tool-builder/spec.yaml b/skills/huggingface-tool-builder/spec.yaml index 123e2808..65fba8e9 100644 --- a/skills/huggingface-tool-builder/spec.yaml +++ b/skills/huggingface-tool-builder/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-tool-builder" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-trackio/spec.yaml b/skills/huggingface-trackio/spec.yaml index 7f162e31..5d4caab9 100644 --- a/skills/huggingface-trackio/spec.yaml +++ b/skills/huggingface-trackio/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-trackio" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-vision-trainer/spec.yaml b/skills/huggingface-vision-trainer/spec.yaml index 32893de7..b8dd7ab6 100644 --- a/skills/huggingface-vision-trainer/spec.yaml +++ b/skills/huggingface-vision-trainer/spec.yaml @@ -13,7 +13,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/huggingface-vision-trainer" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/transformers-js/spec.yaml b/skills/transformers-js/spec.yaml index 849d9d7e..e695e1df 100644 --- a/skills/transformers-js/spec.yaml +++ b/skills/transformers-js/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/huggingface/skills" ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 path: "skills/transformers-js" - version: "0.3.0" + version: "0.3.1" provenance: repository_uri: "https://github.com/huggingface/skills" From fd452132d8a80259c9c5978101e5a5cf352e7b80 Mon Sep 17 00:00:00 2001 From: Dan Barr Date: Fri, 18 Sep 2026 13:27:03 -0400 Subject: [PATCH 3/5] Defer four Hugging Face skill updates Signed-off-by: danbarr <6922515+danbarr@users.noreply.github.com> --- skills/huggingface-community-evals/spec.yaml | 4 ++-- skills/huggingface-llm-trainer/spec.yaml | 4 ++-- skills/huggingface-papers/spec.yaml | 4 ++-- skills/huggingface-vision-trainer/spec.yaml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/skills/huggingface-community-evals/spec.yaml b/skills/huggingface-community-evals/spec.yaml index 3eba70fe..5b192bb7 100644 --- a/skills/huggingface-community-evals/spec.yaml +++ b/skills/huggingface-community-evals/spec.yaml @@ -9,9 +9,9 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 + ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 path: "skills/huggingface-community-evals" - version: "0.3.1" + version: "0.3.0" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-llm-trainer/spec.yaml b/skills/huggingface-llm-trainer/spec.yaml index ddfa538a..8d38c646 100644 --- a/skills/huggingface-llm-trainer/spec.yaml +++ b/skills/huggingface-llm-trainer/spec.yaml @@ -12,9 +12,9 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 + ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 path: "skills/huggingface-llm-trainer" - version: "0.3.1" + version: "0.3.0" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-papers/spec.yaml b/skills/huggingface-papers/spec.yaml index e6a332c4..8729aad0 100644 --- a/skills/huggingface-papers/spec.yaml +++ b/skills/huggingface-papers/spec.yaml @@ -9,9 +9,9 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 + ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 path: "skills/huggingface-papers" - version: "0.3.1" + version: "0.3.0" provenance: repository_uri: "https://github.com/huggingface/skills" diff --git a/skills/huggingface-vision-trainer/spec.yaml b/skills/huggingface-vision-trainer/spec.yaml index b8dd7ab6..8e400906 100644 --- a/skills/huggingface-vision-trainer/spec.yaml +++ b/skills/huggingface-vision-trainer/spec.yaml @@ -11,9 +11,9 @@ metadata: spec: repository: "https://github.com/huggingface/skills" - ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16 + ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16 path: "skills/huggingface-vision-trainer" - version: "0.3.1" + version: "0.3.0" provenance: repository_uri: "https://github.com/huggingface/skills" From a2f9b101f3fe3e2d09114ab08ef2366b9e916a2b Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Fri, 18 Sep 2026 15:11:24 -0400 Subject: [PATCH 4/5] Refresh trusted skill scan Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com> From ebde9e7cf0df34d1e948792d9aa578b369f60948 Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Fri, 18 Sep 2026 15:30:54 -0400 Subject: [PATCH 5/5] Accept HF job supply-chain risk Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com> --- skills/hf-mcp/spec.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/skills/hf-mcp/spec.yaml b/skills/hf-mcp/spec.yaml index 79d8e5b7..8361c166 100644 --- a/skills/hf-mcp/spec.yaml +++ b/skills/hf-mcp/spec.yaml @@ -53,6 +53,8 @@ security: reason: "FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b." - rule_id: LLM_COMMAND_INJECTION reason: "Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): documented first-party HF Hub MCP behavior. SKILL.md shows passing script/shell-command content to the hf_jobs tool, which by design executes user-authored jobs on HF Jobs cloud GPU containers. This execution surface is inherent to the HF MCP server's purpose (running training/compute jobs); it is user-initiated and runs in ephemeral remote containers, not covert injection." + - rule_id: LLM_SUPPLY_CHAIN_ATTACK + reason: "Risk accepted by maintainer (danbarr, 2026-09-18): the documented training example installs the Hugging Face-maintained transformers and trl packages at runtime in a user-initiated, ephemeral HF Jobs container. Jobs needing private-repository access explicitly receive an HF token, so mutable package dependencies in that environment carry supply-chain exposure; this is accepted as part of the skill's first-party remote-compute workflow." - rule_id: LLM_DATA_EXFILTRATION reason: "Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): SKILL.md documents passing HF_TOKEN as a job secret to hf_jobs so remote jobs can authenticate to the HF Hub. Forwarding the user's own HF credential to HF's own job infrastructure is first-party, user-initiated authentication inherent to the HF MCP server; not covert third-party data exfiltration." - rule_id: LLM_PROMPT_INJECTION