hf-cli
Manages Hugging Face Hub repositories, models, and datasets using the CLI for efficient AI project workflows.
Install this skill
Security score
The hf-cli skill was audited on Jun 13, 2026 and we found 13 security issues across 3 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Piping content to bash shell
| 6 | Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`. |
Piping content to sh shell
| 207 | Install: `curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh` |
Curl to non-GitHub URL
| 6 | Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`. |
Webhook reference - potential data exfiltration
| 3 | description: "Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authenti |
Webhook reference - potential data exfiltration
| 185 | ### `hf webhooks` — Manage webhooks on the Hub. |
Webhook reference - potential data exfiltration
| 187 | - `hf webhooks create --watch TEXT` — Create a new webhook. `[--url TEXT --job-id TEXT --domain [repo|discussions] --secret TEXT --format [auto|human|agent|json|quiet]]` |
Webhook reference - potential data exfiltration
| 188 | - `hf webhooks delete WEBHOOK_ID` — Delete a webhook permanently. `[--yes --format [auto|human|agent|json|quiet]]` |
Webhook reference - potential data exfiltration
| 189 | - `hf webhooks disable WEBHOOK_ID` — Disable an active webhook. `[--format [auto|human|agent|json|quiet]]` |
Webhook reference - potential data exfiltration
| 190 | - `hf webhooks enable WEBHOOK_ID` — Enable a disabled webhook. `[--format [auto|human|agent|json|quiet]]` |
Webhook reference - potential data exfiltration
| 191 | - `hf webhooks info WEBHOOK_ID` — Show full details for a single webhook. `[--format [auto|human|agent|json|quiet]]` |
Webhook reference - potential data exfiltration
| 192 | - `hf webhooks list` — List all webhooks for the current user. `[--format [auto|human|agent|json|quiet]]` |
Webhook reference - potential data exfiltration
| 193 | - `hf webhooks update WEBHOOK_ID` — Update an existing webhook. Only provided options are changed. `[--url TEXT --watch TEXT --domain [repo|discussions] --secret TEXT --format [auto|human|agent|json|q |
External URL reference
| 6 | Install: `curl -LsSf https://hf.co/cli/install.sh | bash -s`. |