Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. This is especially useful when chaining or combining API calls or the task will be repeated/automated. This Skill creates a reusable script to fetch, enrich or process data.
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
Your purpose is now is to create reusable command line scripts and utilities for using the Hugging Face API, allowing chaining, piping and intermediate processing where helpful. You can access the API directly, as well as use the hf command line tool. Model and Dataset cards can be accessed from repositories directly.
Make sure to follow these rules:
--help command line argument to describe their inputs and outputsHF_TOKEN environment variable as an Authorization header. For example: curl -H "Authorization: Bearer ${HF_TOKEN}" https://huggingface.co/api/. This provides higher rate limits and appropriate authorization for data access.Be sure to confirm User preferences where there are questions or clarifications needed.
Paths below are relative to this skill directory.
Reference examples:
references/hf_model_papers_auth.sh — uses HF_TOKEN automatically and chains trending → model metadata → model card parsing with fallbacks; it demonstrates multi-step API usage plus auth hygiene for gated/private content.references/find_models_by_paper.sh — optional HF_TOKEN usage via --token, consistent authenticated search, and a retry path when arXiv-prefixed searches are too narrow; it shows resilient query strategy and clear user-facing help.references/hf_model_card_frontmatter.sh — uses the hf CLI to download model cards, extracts YAML frontmatter, and emits NDJSON summaries (license, pipeline tag, tags, gated prompt flag) for easy filtering.Baseline examples (ultra-simple, minimal logic, raw JSON output with HF_TOKEN header):
references/baseline_hf_api.sh — bashreferences/baseline_hf_api.py — pythonreferences/baseline_hf_api.tsx — typescript executableComposable utility (stdin → NDJSON):
references/hf_enrich_models.sh — reads model IDs from stdin, fetches metadata per ID, emits one JSON object per line for streaming pipelines.Composability through piping (shell-friendly JSON output):
references/baseline_hf_api.sh 25 | jq -r '.[].id' | references/hf_enrich_models.sh | jq -s 'sort_by(.downloads) | reverse | .[:10]'references/baseline_hf_api.sh 50 | jq '[.[] | {id, downloads}] | sort_by(.downloads) | reverse | .[:10]'printf '%s\n' openai/gpt-oss-120b meta-llama/Meta-Llama-3.1-8B | references/hf_model_card_frontmatter.sh | jq -s 'map({id, license, has_extra_gated_prompt})'The following are the main API endpoints available at https://huggingface.co
/api/datasets
/api/models
/api/spaces
/api/collections
/api/daily_papers
/api/notifications
/api/settings
/api/whoami-v2
/api/trending
/oauth/userinfo
The API is documented with the OpenAPI standard at https://huggingface.co/.well-known/openapi.json.
IMPORTANT: DO NOT ATTEMPT to read https://huggingface.co/.well-known/openapi.json directly as it is too large to process.
IMPORTANT Use jq to query and extract relevant parts. For example,
Command to Get All 160 Endpoints
curl -s "https://huggingface.co/.well-known/openapi.json" | jq '.paths | keys | sort'
Model Search Endpoint Details
curl -s "https://huggingface.co/.well-known/openapi.json" | jq '.paths["/api/models"]'
You can also query endpoints to see the shape of the data. When doing so constrain results to low numbers to make them easy to process, yet representative.
The hf command line tool gives you further access to Hugging Face repository content and infrastructure.
❯ hf --help
Usage: hf [OPTIONS] COMMAND [ARGS]...
Hugging Face Hub CLI
Options:
--help Show this message and exit.
Commands:
auth Manage authentication (login, logout, etc.).
buckets Commands to interact with buckets.
cache Manage local cache directory.
collections Interact with collections on the Hub.
datasets Interact with datasets on the Hub.
discussions Manage discussions and pull requests on the Hub.
download Download files from the Hub.
endpoints Manage Hugging Face Inference Endpoints.
env Print information about the environment.
extensions Manage hf CLI extensions.
jobs Run and manage Jobs on the Hub.
models Interact with models on the Hub.
papers Interact with papers on the Hub.
repos Manage repos on the Hub.
skills Manage skills for AI assistants.
spaces Interact with spaces on the Hub.
sync Sync files between local directory and a bucket.
upload Upload a file or a folder to the Hub.
upload-large-folder Upload a large folder to the Hub.
version Print information about the hf version.
webhooks Manage webhooks on the Hub.
The hf CLI command has replaced the now deprecated huggingface-cli command.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate project context. Use when the user asks to check, audit, review, update, improve, or fix their AGENTS.md or CLAUDE.md, mentions "project rules maintenance" or "agent context optimization", or when the codebase has changed enough that the rules file may be stale. Scans the repository for every rules file, grades each against a quality rubric, outputs a quality report, and applies targeted edits only after user approval.
日本語の概要は準備中です。原文の説明を表示しています。
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future sessions benefit. Use when the user says "revise the rules", "update AGENTS.md / CLAUDE.md with what we just learned", "save this to project memory", "remember this for next time", or at the end of a productive session when valuable context has emerged that is not yet documented. This complements agents-md-improver — improver audits, while this one captures.
日本語の概要は準備中です。原文の説明を表示しています。
Operational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair actions for interface design. Use as the reference rubric when building or reviewing marketing sites, product interfaces, dashboards, portfolios, or e-commerce pages, especially alongside frontend-design.
日本語の概要は準備中です。原文の説明を表示しています。
Design a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive implementation blueprint with specific files to create or modify, component designs, data flows, and a build sequence. Use this skill when the user asks for an architecture design, an implementation plan for a non-trivial feature, or when dispatched as a sub-task during feature-dev architecture phase.
日本語の概要は準備中です。原文の説明を表示しています。
Deeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and abstractions, and documenting dependencies. Use this skill when you need to understand how a feature works before modifying or extending it, when dispatched as a sub-task during feature-dev exploration, or when the user asks "how does X work in this codebase".
日本語の概要は準備中です。原文の説明を表示しています。