chore(deps): update huggingface/skills digest to cead19e

[renovate]

This PR contains the following updates:

Package	Update	Change
huggingface/skills	digest	ec01082 → cead19e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ hf-cli

• Status: Passed
• Findings: 4
• Allowed (not blocking): 2
  • ATR_2026_00111 (Allowed: FP: cisco-ai-skill-scanner matched the documented official hf-mount
    installer one-liner (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh,
    SKILL.md:195) - the same official Hugging Face installer URL allowlisted
    above for PIPELINE_TAINT_FLOW / ATR_MCP_MALICIOUS_RESPONSE. Documentation
    prose, no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.
    )
  • PIPELINE_TAINT_FLOW (Allowed: The skill's prerequisites cite the official hf CLI installer (curl -LsSf https://hf.co/cli/install.sh | bash) and the hf-mount installer (curl -fsSL https://raw.githubusercontent.com/huggingface/hf-mount/main/install.sh | sh) as documented install commands. The scanner itself flags both as 'instructional install text in SKILL.md'.)

✅ hf-mcp

• Status: Passed
• Findings: 3

✅ huggingface-community-evals

• Status: Passed
• Findings: 3

✅ huggingface-datasets

• Status: Passed
• Findings: 6
• Allowed (not blocking): 4
  • LLM_DATA_EXFILTRATION (Allowed: Risk accepted by maintainer (ozz@stacklok.com, 2026-06-03): the 'Agent Traces' dataset upload is first-party, user-initiated functionality. The skill reads local agent session dirs (~/.claude/projects, ~/.codex/sessions, ~/.pi/agent/sessions) and uploads JSONL to the user's own HF Datasets repo; the skill itself documents the PII/secret risk and recommends private repos. The same finding also flags HF_TOKEN being set/used in upload CLI commands — standard HF authentication. Not covert third-party exfiltration.)
  • ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
  • ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)
  • ATR_2026_00063 (Allowed: FP: cisco-ai-skill-scanner word-fragment match on the word Upload/upload in SKILL.md prose/code examples for creating-and-uploading datasets via the public HF Hub; no executable threat. huggingface/skills @35810a6dbe518a0f7bd99b1e6550cb57b266ff0b.)

✅ huggingface-gradio

• Status: Passed
• Findings: 0

❌ huggingface-llm-trainer

• Status: Failed
• Findings: 9
• Blocking: 5

Blocking issues:

• [LLM_COMMAND_INJECTION] (HIGH) The GGUF conversion script enables trust_remote_code=True when loading both the base model and tokenizer. Model repository owners can supply custom Python code that Transformers imports and executes. Because BASE_MODEL and ADAPTER_MODEL are environment-configurable, a user-supplied or compromised repository can cause arbitrary code execution in the Jobs environment, where HF_TOKEN and uploaded model artifacts may be accessible. (scripts/convert_to_gguf.py)
• [LLM_SUPPLY_CHAIN_ATTACK] (HIGH) The conversion workflow clones the moving main branch of llama.cpp and immediately installs the cloned repository's requirements. A compromise of the upstream repository, a malicious dependency change, or a network/provenance substitution would execute unreviewed code during pip install and subsequent conversion. The shallow-clone fallback remains equally unpinned. (scripts/convert_to_gguf.py)
• [META_DETECTED] (HIGH) scripts/convert_to_gguf.py clones the moving main branch of llama.cpp into /tmp, installs its requirements with pip, and executes its conversion script. It also uses trust_remote_code=True when loading model and tokenizer repositories. A compromised upstream repository, malicious model repository, or dependency update can execute arbitrary code in the conversion environment. (scripts/convert_to_gguf.py)
• [META_DETECTED] (HIGH) The script clones the moving HEAD of llama.cpp, installs its requirements, and executes its converter. A compromised upstream repository, dependency, or network path could execute code in the conversion environment, potentially with the supplied HF_TOKEN. (scripts/convert_to_gguf.py)
• [META_DETECTED] (HIGH) trust_remote_code=True permits Python code supplied by the selected base model or adapter repository to run during model/tokenizer loading. BASE_MODEL and ADAPTER_MODEL are environment-controlled. (scripts/convert_to_gguf.py)

Allowlisted (not blocking):

• TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill orchestrates training jobs on Hugging Face Jobs cloud GPUs via the HF MCP server's hf_jobs tool. The network requirement is through the HF MCP server dependency (packaged in toolhive-catalog under registries/official/servers/huggingface), not a direct network-access tool in frontmatter.)

✅ huggingface-paper-publisher

• Status: Passed
• Findings: 4
• Allowed (not blocking): 4
  • TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill uses network access through its bundled paper_manager.py script (as its documented workflow), but does not declare an explicit network-access tool in frontmatter. All network calls target the public Hugging Face Hub API documented in the SKILL.md.)
  • LLM_SUPPLY_CHAIN_ATTACK (Allowed: SKILL.md documents its bundled script's Python dependencies with minimum-version (>=) constraints (huggingface_hub, pyyaml, requests, markdown, python-dotenv) in an informational 'Dependencies' list read by a human setting up the script locally; Dockyard does not execute or resolve this list at packaging or run time, so it isn't an exploitable install path here. Accepted as inherent to how this vendored skill documents its own script's requirements.)
  • MANIFEST_MISSING_LICENSE (Allowed: huggingface/skills is licensed Apache-2.0 at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • LLM_UNAUTHORIZED_TOOL_USE (Allowed: Accepted risk, not a false positive - the skill's link command
    genuinely does write metadata/citations directly to the
    user-specified Hugging Face repo by default (the --create-pr flag,
    which routes changes through a PR instead, is optional rather than
    default). This is real, intended behavior: the user supplies their
    own write-scoped HF_TOKEN and explicitly names the target repo-id,
    so it operates only on repos the user already controls and named,
    not an arbitrary or attacker-chosen target. Accepted as inherent to
    a first-party HF metadata-publishing tool rather than disputed as
    inapplicable.
    )

✅ huggingface-papers

• Status: Passed
• Findings: 4

✅ huggingface-tool-builder

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • TOOL_ABUSE_UNDECLARED_NETWORK (Allowed: The skill uses network access through its bundled reference scripts that call the public Hugging Face Hub API. The frontmatter does not declare a dedicated network-access tool, but the network calls are documented examples bundled for user education, not runtime execution by the skill itself.)

✅ huggingface-trackio

• Status: Passed
• Findings: 2

✅ huggingface-vision-trainer

• Status: Passed
• Findings: 3

✅ transformers-js

• Status: Passed
• Findings: 1

---

Summary: Scanned 12 skill(s), found 5 blocking issue(s).

⚠️ Action Required: Review the blocking findings. Add a justified entry to the skill's security.allowed_issues[] in its spec.yaml if the finding is a false positive.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.