Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Train object-detection, image-classification, or SAM segmentation models on Hugging Face Jobs. Use for vision fine-tuning and evaluation; use huggingface-llm-trainer for language models.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Train object detection, image classification, and SAM/SAM2 segmentation models on managed cloud GPUs. No local GPU setup required — results are automatically saved to the Hugging Face Hub. For text/language model fine-tuning (SFT/DPO/GRPO via TRL), use this pack's huggingface-llm-trainer skill instead.
Fine-tuning object detection models (D-FINE, RT-DETR v2, DETR, YOLOS), image classification models (any timm/ model or Transformers classifier), or SAM/SAM2 segmentation models (bbox or point prompts) on custom datasets — locally or on Hugging Face Jobs.
Helper scripts use PEP 723 inline dependencies:
uv run scripts/dataset_inspector.py --dataset username/dataset-name --split train
uv run scripts/estimate_cost.py --help
hf auth whoami), token with write permissions passed in job secrets.objects column (bbox, category, optional area). Bboxes in xywh (COCO) or xyxy (Pascal VOC) — auto-detected/converted. Categories can be integers or strings (auto-remapped). image_id optional, auto-generated.image column (PIL images) and a label column (integer or string class IDs, ClassLabel or plain — auto-remapped). Common alt names (labels, class, fine_label) auto-detected.image column, a mask column (binary ground-truth mask), and a prompt — either a prompt column with JSON ({"bbox": [...]} or {"point": [...]}), or dedicated bbox/point columns (xyxy, absolute pixels). Example dataset: merve/MicroMat-mini.push_to_hub=True, hub_model_id="username/model-name", token in secrets.Validate BEFORE launching GPU training — the #1 cause of training failures is format mismatches. Skip only for well-known defaults (e.g. cppe-5). Run via Jobs (avoids local SSL/dependency issues), locally with uv run scripts/dataset_inspector.py --dataset ... --split train, or via HfApi().run_uv_job(script="scripts/dataset_inspector.py", script_args=[...], flavor="cpu-basic", timeout=300). Output markers: ✓ READY or ✗ NEEDS FORMATTING (with mapping code).
The object detection training script auto-handles bbox format detection/conversion, sanitization, image_id generation, and category remapping — no manual preprocessing needed beyond having objects.bbox/objects.category.
scripts/object_detection_training.py (OD), scripts/image_classification_training.py (IC), or scripts/sam_segmentation_training.py (SAM). All use HfArgumentParser — configure via CLI-style script_args, not by editing Python variables. See references/timm_trainer.md for timm details and references/finetune_sam2_trainer.md for SAM2 details.submitted_jobs/<dataset>_<timestamp>.py, submit the job, and report the job ID, monitoring URL, Trackio dashboard (https://huggingface.co/spaces/{username}/trackio), expected time, and estimated cost. Wait for the user to request status checks — don't poll; jobs are asynchronous and can take hours.Submit via the hf jobs uv run CLI, an hf_jobs() MCP tool if the Hugging Face MCP server is configured, or the Python API directly:
from huggingface_hub import HfApi, get_token
api = HfApi()
job_info = api.run_uv_job(
script="scripts/object_detection_training.py", # file PATH, not inline content, for the Python API
script_args=["--dataset_name", "cppe-5", "--push_to_hub", "--hub_model_id", "username/model-name", ...],
flavor="a10g-large",
timeout=14400, # seconds
env={"PYTHONUNBUFFERED": "1"},
secrets={"HF_TOKEN": get_token()}, # use get_token(), not the literal string "$HF_TOKEN"
)
print(f"Job ID: {job_info.id}") # .id, not .job_id or .name
If using an MCP hf_jobs() tool instead, the script parameter accepts inline code or a URL (not local paths), timeout is a string ("4h"), and secrets use the literal "$HF_TOKEN" placeholder (auto-replaced) rather than get_token(). Either way, the training script must include PEP 723 inline dependency metadata and must NOT use image/command parameters (those belong to a different job type).
Token injection is required in custom scripts: the Transformers Trainer calls create_repo(token=self.args.hub_token) when push_to_hub=True, so the script must set training_args.hub_token from os.environ.get("HF_TOKEN") after parsing args but before constructing Trainer — scripts/object_detection_training.py already does this; replicate it in custom scripts. Don't call login() unless replicating that same pattern, and don't rely on implicit token resolution.
Object detection: --no_remove_unused_columns (preserves the image column), --no_eval_do_concat_batches (variable box counts per image), --push_to_hub, --hub_model_id, --metric_for_best_model eval_map, --greater_is_better True (must be explicit — it's Optional[bool]), --do_train, --do_eval.
Image classification: --no_remove_unused_columns, --push_to_hub, --hub_model_id, --metric_for_best_model eval_accuracy, --greater_is_better True, --do_train, --do_eval.
SAM/SAM2: --remove_unused_columns False (preserves input_boxes/input_points), --push_to_hub, --hub_model_id, --do_train, --prompt_type bbox (or point), --dataloader_pin_memory False (avoids pin_memory issues with the custom collator).
Bare bool flags (push_to_hub, do_train) can be negated with --no_ prefix; Optional[bool] fields (greater_is_better) require an explicit True/False value.
Default 30min is too short for vision training. Minimum 2-4h, with a 30% buffer for loading/preprocessing/Hub push: quick test (100-200 images) 1h, development (500-1K images) 2-3h, production (1K-5K images) 4-6h, large (5K+) 6-12h.
Always enabled in the object detection script (calls trackio.init()/trackio.finish() automatically, project name from --output_dir, run name from --run_name). For image classification, pass --report_to trackio explicitly. Dashboard: https://huggingface.co/spaces/{username}/trackio.
Object detection (all under 100M params — t4-small, 16GB/$0.40/hr, is sufficient): start with ustc-community/dfine-small-coco (10.4M, fast/cheap SOTA), move up to ustc-community/dfine-large-coco (31.4M) or PekingU/rtdetr_v2_r50vd (43M) for accuracy; ustc-community/dfine-xlarge-obj365 (63.5M) and PekingU/rtdetr_v2_r101vd (76M) for the largest variants.
Image classification (timm/ models work out of the box via AutoModelForImageClassification, see references/timm_trainer.md): start with timm/mobilenetv3_small_100.lamb_in1k (2.5M, mobile/edge), move to timm/resnet50.a1_in1k (25.6M) or timm/vit_base_patch16_dinov3.lvd1689m (86.6M, best accuracy).
SAM/SAM2 (only the mask decoder trains by default — vision/prompt encoders frozen): start with facebook/sam2.1-hiera-small (46.0M); facebook/sam2.1-hiera-tiny (38.9M) for speed, facebook/sam2.1-hiera-large (224.4M) or the original facebook/sam-vit-* family for best accuracy at higher VRAM cost.
t4-small handles all recommended OD/IC models and SAM2 up to hiera-base-plus; use l4x1 ($0.80/hr) or a10g-large ($1.50/hr) for sam2.1-hiera-large or SAM v1 models, or if you hit OOM (reduce batch size first). Run scripts/estimate_cost.py for a cost estimate.
Via MCP tool if available: hf_jobs("ps"), hf_jobs("logs", {"job_id": "..."}), hf_jobs("inspect", {"job_id": "..."}). Via Python API: HfApi().list_jobs(), .get_job_logs(job_id=...), .get_job(job_id=...).
per_device_train_batch_size (try 4, then 2), reduce image size, or upgrade hardware.scripts/dataset_inspector.py first; ensure objects.bbox/objects.category are well-formed.training_args.hub_token before constructing Trainer, push_to_hub=True, correct hub_model_id, and write permissions.hub_strategy="every_save".KeyError: 'test': the OD script falls back to the validation split automatically — use the latest template.torchmetrics.MeanAveragePrecision returns scalar tensors for one-class datasets — the OD template already .unsqueeze(0)s these.See references/reliability_principles.md for the full guide.
Scripts: scripts/object_detection_training.py, image_classification_training.py, sam_segmentation_training.py, dataset_inspector.py, estimate_cost.py.
References: references/object_detection_training_notebook.md, image_classification_training_notebook.md, finetune_sam2_trainer.md, timm_trainer.md, hub_saving.md, reliability_principles.md.
External: Object Detection Guide, Image Classification Guide, HF Jobs Guide, HF Jobs Configuration, SAM2 docs, SAM docs.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate project context. Use when the user asks to check, audit, review, update, improve, or fix their AGENTS.md or CLAUDE.md, mentions "project rules maintenance" or "agent context optimization", or when the codebase has changed enough that the rules file may be stale. Scans the repository for every rules file, grades each against a quality rubric, outputs a quality report, and applies targeted edits only after user approval.
日本語の概要は準備中です。原文の説明を表示しています。
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future sessions benefit. Use when the user says "revise the rules", "update AGENTS.md / CLAUDE.md with what we just learned", "save this to project memory", "remember this for next time", or at the end of a productive session when valuable context has emerged that is not yet documented. This complements agents-md-improver — improver audits, while this one captures.
日本語の概要は準備中です。原文の説明を表示しています。
Operational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair actions for interface design. Use as the reference rubric when building or reviewing marketing sites, product interfaces, dashboards, portfolios, or e-commerce pages, especially alongside frontend-design.
日本語の概要は準備中です。原文の説明を表示しています。
Design a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive implementation blueprint with specific files to create or modify, component designs, data flows, and a build sequence. Use this skill when the user asks for an architecture design, an implementation plan for a non-trivial feature, or when dispatched as a sub-task during feature-dev architecture phase.
日本語の概要は準備中です。原文の説明を表示しています。
Deeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and abstractions, and documenting dependencies. Use this skill when you need to understand how a feature works before modifying or extending it, when dispatched as a sub-task during feature-dev exploration, or when the user asks "how does X work in this codebase".
日本語の概要は準備中です。原文の説明を表示しています。