Skip to content

chore(deps): update huggingface/skills digest to abc20ae #923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 5 commits into
base: main
Choose a base branch
from
Open

chore(deps): update huggingface/skills digest to abc20ae #923

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
532af99
chore(deps): update huggingface/skills digest to abc20ae
renovate[bot] Sep 18, 2026
6e545a3
chore(skills): bump spec.version for hf-cli,hf-mcp,huggingface-commun…
toolhive-release-app[bot] Sep 18, 2026
fd45213
Defer four Hugging Face skill updates
danbarr Sep 18, 2026
a2f9b10
Refresh trusted skill scan
danbarr Sep 18, 2026
ebde9e7
Accept HF job supply-chain risk
danbarr Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions skills/hf-cli/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/hf-cli"
version: "0.3.0"
version: "0.4.0"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
6 changes: 4 additions & 2 deletions skills/hf-mcp/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "hf-mcp/skills/hf-mcp"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down Expand Up @@ -53,6 +53,8 @@ security:
reason: "FP: cisco-ai-skill-scanner matched documentation prose/code examples; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b."
- rule_id: LLM_COMMAND_INJECTION
reason: "Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): documented first-party HF Hub MCP behavior. SKILL.md shows passing script/shell-command content to the hf_jobs tool, which by design executes user-authored jobs on HF Jobs cloud GPU containers. This execution surface is inherent to the HF MCP server's purpose (running training/compute jobs); it is user-initiated and runs in ephemeral remote containers, not covert injection."
- rule_id: LLM_SUPPLY_CHAIN_ATTACK
reason: "Risk accepted by maintainer (danbarr, 2026-09-18): the documented training example installs the Hugging Face-maintained transformers and trl packages at runtime in a user-initiated, ephemeral HF Jobs container. Jobs needing private-repository access explicitly receive an HF token, so mutable package dependencies in that environment carry supply-chain exposure; this is accepted as part of the skill's first-party remote-compute workflow."
- rule_id: LLM_DATA_EXFILTRATION
reason: "Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): SKILL.md documents passing HF_TOKEN as a job secret to hf_jobs so remote jobs can authenticate to the HF Hub. Forwarding the user's own HF credential to HF's own job infrastructure is first-party, user-initiated authentication inherent to the HF MCP server; not covert third-party data exfiltration."
- rule_id: LLM_PROMPT_INJECTION
Expand Down
4 changes: 2 additions & 2 deletions skills/huggingface-datasets/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/huggingface-datasets"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
4 changes: 2 additions & 2 deletions skills/huggingface-gradio/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/huggingface-gradio"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
4 changes: 2 additions & 2 deletions skills/huggingface-paper-publisher/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/huggingface-paper-publisher"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
4 changes: 2 additions & 2 deletions skills/huggingface-tool-builder/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/huggingface-tool-builder"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
4 changes: 2 additions & 2 deletions skills/huggingface-trackio/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/huggingface-trackio"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
4 changes: 2 additions & 2 deletions skills/transformers-js/spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ metadata:

spec:
repository: "https://github.com/huggingface/skills"
ref: "ec0108293521ef698e451ec044e8b4feba6b732b" # main as of 2026-04-16
ref: "abc20ae526d8b4c0e4dff89f904adce28a4a0eb6" # main as of 2026-04-16
path: "skills/transformers-js"
version: "0.3.0"
version: "0.3.1"

provenance:
repository_uri: "https://github.com/huggingface/skills"
Expand Down
Loading