feat(skills): package 12 Hugging Face skills#501
Merged
Conversation
Packages 9 Hugging Face platform skills from huggingface/skills
(Apache-2.0) into Dockyard, pinned to upstream commit 061ab49 (main as
of 2026-04-16).
Fifth vendor in the per-vendor skills sweep.
Tooling and CLIs:
- hf-cli — Hub CLI (replaces huggingface-cli); auth, cache, buckets,
repos, discussions, collections, jobs, endpoints, webhooks
- huggingface-tool-builder — build reusable HF API scripts with `hf`
CLI + curl/REST
Hub content:
- huggingface-datasets — Dataset Viewer API + parquetlens SQL
- huggingface-papers — read paper pages as markdown, use papers API
- huggingface-paper-publisher — create/link/claim papers
- huggingface-trackio — experiment tracking (logging, alerts, CLI)
Frameworks:
- huggingface-gradio — Gradio UIs and demos in Python
- transformers-js — Transformers.js for browser/Node.js/Bun/Deno
Evaluation:
- huggingface-community-evals — local inspect-ai / lighteval evals
Skills intentionally excluded (MCP server dependency):
Per skill-criteria.md ("If a skill declares a dependency on one or
more MCP servers, every referenced MCP server must already be included
in the catalog"), three upstream skills are excluded from this PR
because they depend on the Hugging Face MCP server which is not yet
packaged in Dockyard:
- hf-mcp — entirely a guide to using HF MCP server tools
- huggingface-llm-trainer — mandates `hf_jobs()`, `hf_whoami()`,
`hf_doc_search()`, `hf_doc_fetch()` MCP tool calls
- huggingface-vision-trainer — uses `hf_jobs()` and `hf_whoami()`
MCP tools throughout
These can be added in a follow-up once the HF MCP server is
packaged in Dockyard (npx/uvx/go tree).
Security allowlists:
All 9 carry MANIFEST_MISSING_LICENSE — upstream Apache-2.0 at repo root,
not per-skill SPDX.
- hf-cli: PIPELINE_TAINT_FLOW — documented `curl | bash` installers
for `hf` CLI and `hf-mount`; scanner flags them as 'instructional
install text'.
- huggingface-paper-publisher: DATA_EXFIL_NETWORK_REQUESTS,
TOOL_ABUSE_UNDECLARED_NETWORK (official HF API calls),
FILE_MAGIC_MISMATCH (Handlebars-style paper template).
- huggingface-tool-builder: DATA_EXFIL_NETWORK_REQUESTS,
TOOL_ABUSE_UNDECLARED_NETWORK, LOW_ANALYZABILITY — baseline
reference scripts that call the public HF API (the skill teaches
users to build such scripts).
All 9 pass `task validate-skill` and `task scan-skill`.
Refs #477
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
🛡️ Skill Security Scan Results✅ hf-cli
✅ hf-mcp
✅ huggingface-community-evals
✅ huggingface-datasets
✅ huggingface-gradio
✅ huggingface-llm-trainer
✅ huggingface-paper-publisher
✅ huggingface-papers
✅ huggingface-tool-builder
✅ huggingface-trackio
✅ huggingface-vision-trainer
✅ transformers-js
Summary: Scanned 12 skill(s), all passed security checks. ✅ |
Adds the three HF skills initially excluded for MCP-server dependency: - hf-mcp - huggingface-llm-trainer - huggingface-vision-trainer These depend on the Hugging Face MCP server, which IS already packaged in the toolhive-catalog (registries/official/servers/huggingface) — the registry of record, which dockyard repackages from. The skill-criteria.md "MCP server dependency" requirement is satisfied. Total HF skills in this PR now: 12. Per-skill allowlists added: - huggingface-llm-trainer: TOOL_ABUSE_UNDECLARED_NETWORK (network via HF MCP `hf_jobs` tool), SOCIAL_ENG_MISLEADING_DESC (scanner conservatism on broad skill scope), TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (GGUF conversion script uses apt-get/yum inside ephemeral Jobs containers), DATA_EXFIL_NETWORK_REQUESTS (HF-API calls in dataset inspector and benchmarks helpers). - huggingface-vision-trainer: same network/scope allowlists plus DATA_EXFIL_NETWORK_REQUESTS for dataset_inspector.py. - hf-mcp: only MANIFEST_MISSING_LICENSE. Refs #477 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
JAORMX
changed the title
samuv
approved these changes
Apr 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Packages 12 Hugging Face platform skills from
huggingface/skills(Apache-2.0) into Dockyard. All skills pinned to upstream commit061ab49(main as of 2026-04-16).Fifth vendor in the per-vendor skills sweep.
Tracks #477.
Skills added
Tooling and CLIs
hf-cli— Hugging Face Hub CLI (hf) — replaces the deprecatedhuggingface-clihuggingface-tool-builder— build reusable HF API scripts viahfCLI and curl/RESThf-mcp— use the Hugging Face Hub via MCP server toolsHub content
huggingface-datasets— Dataset Viewer API workflows + parquetlens SQLhuggingface-papers— read Hugging Face paper pages as markdown; papers APIhuggingface-paper-publisher— create, link, and claim papers on the Hubhuggingface-trackio— experiment tracking with Trackio (logging, alerts, CLI)Frameworks
huggingface-gradio— build Gradio web UIs and demos in Pythontransformers-js— Transformers.js for browser/Node.js/Bun/DenoEvaluation and training
huggingface-community-evals— local evaluations via inspect-ai or lightevalhuggingface-llm-trainer— TRL/Unsloth SFT/DPO/GRPO training on HF Jobshuggingface-vision-trainer— vision model training on HF Jobs (object detection, classification, SAM/SAM2)MCP server dependency
Three of these skills depend on the Hugging Face MCP server (
hf_jobs,hf_whoami,hf_doc_search,hf_doc_fetch, etc.):hf-mcphuggingface-llm-trainerhuggingface-vision-trainerPer
skill-criteria.md, skills that depend on MCP servers are only eligible if the server is already in the ToolHive catalog. The HF MCP server is packaged underregistries/official/servers/huggingface— the dependency is satisfied.Security allowlists
All 12 skills carry
MANIFEST_MISSING_LICENSE(INFO) — upstream is Apache-2.0 at the repo root, not as SPDX in per-skill SKILL.md frontmatter.Additional targeted allowlists, each documented inline with justification in the corresponding
spec.yaml:hf-cli—PIPELINE_TAINT_FLOW(LOW):curl | bashinstallers forhfandhf-mount(flagged by scanner as "instructional").huggingface-paper-publisher—DATA_EXFIL_NETWORK_REQUESTS,TOOL_ABUSE_UNDECLARED_NETWORK,FILE_MAGIC_MISMATCH(Handlebars paper template).huggingface-tool-builder—DATA_EXFIL_NETWORK_REQUESTS,TOOL_ABUSE_UNDECLARED_NETWORK,LOW_ANALYZABILITY(baseline HF API reference scripts).huggingface-llm-trainer—TOOL_ABUSE_UNDECLARED_NETWORK,SOCIAL_ENG_MISLEADING_DESC,TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL(apt/yum in GGUF conversion script inside ephemeral HF Jobs containers),DATA_EXFIL_NETWORK_REQUESTS.huggingface-vision-trainer—TOOL_ABUSE_UNDECLARED_NETWORK,SOCIAL_ENG_MISLEADING_DESC,DATA_EXFIL_NETWORK_REQUESTS.Test plan
task validate-skillon all 12 — all VALIDBuild Skill Artifactsworkflow succeedsskill-scan-reportsurfaces only allowlisted findingsghcr.io/stacklok/dockyard/skills/<name>:0.1.0Closes #477