Hugging Face API Tool Builder
Turn Hugging Face API calls into reusable, composable command-line tools.
The skill requires HF_TOKEN use and permits calls to the Hugging Face API and hf CLI, involving credentials and external network access. No credential theft, covert exfiltration, or destructive default was found, but least privilege, data-flow disclosure, sensitive-data handling, user confirmation, rollback, and source-verification requirements are incomplete, so points are deducted.
The instructions, examples, and some error outputs make common paths plausible. However, there are no committed tests for key paths; status-code handling, timeouts, retries, and input escaping are incomplete. find_models_by_paper.sh also contains unused authentication-command construction and inconsistent --token semantics, so points are deducted. The score remains within the static-review cap.
The audience and main scenarios are reasonably clear, covering API queries, model-card processing, pipelines, and reusable scripts. Input/output contracts, non-fit boundaries, trigger conditions, environment requirements, and Chinese-language support are under-specified. Core functionality depends on huggingface.co and its CLI, which may be difficult to reach from mainland China, so points are deducted.
The skill has clear structure, help requirements, external-tool guidance, and multiple examples, while repository context supplies an Apache-2.0 license and CI/security-policy signals. It lacks pinned versions, a changelog, explicit maintenance ownership, an update path, FAQs, and a complete dependency inventory, so points are deducted.
The skill can guide creation of reusable Hugging Face API scripts and provides composable shell examples. However, output formats are inconsistent, some scripts mix human-readable text with machine-readable data, and abnormal-case behavior and result correctness are not demonstrated by committed execution tests. User review and possible fixes remain necessary, so points are deducted. The score remains within the static-review cap.
The supplied files are auditable, and the examples, endpoint references, and repository CI provide limited evidence. The CI mainly validates generated artifacts rather than the skill scripts' key runtime paths, and there is no third-party execution evidence or multi-source corroboration, so points are deducted. The score remains within the static-review cap.
- Restrict HF_TOKEN permissions, prevent exposure in logs or command lines, and disclose which requests send data to huggingface.co.
- Before use, verify curl, jq, python3, the hf CLI, and network reachability; mainland-China networks may impair core API and download functions.
- Do not treat API responses, model-card content, or downloaded files as trusted input without validation; add status-code handling, timeouts, retries, encoding safeguards, and tests.
- Some scripts do not provide stable machine-readable output, so validate and pin the output contract before integration.
What does this skill do, and when should you use it?
This skill helps agents create reusable command-line scripts and utilities around the Hugging Face API. It supports direct API access as well as the Hugging Face hf CLI for repository content such as model and dataset cards. The workflow emphasizes inspecting API response shapes, authenticating with HF_TOKEN, and composing calls through pipelines and chaining. It fits developers who need repeatable, automated, or multi-step Hugging Face data workflows.
It creates command-line scripts that fetch, enrich, or process Hugging Face data, call Hugging Face API endpoints or the hf CLI, read model and dataset cards, and emit JSON, NDJSON, or other shell-friendly output. Scripts are expected to provide --help; non-destructive scripts should be tested before delivery; and HF_TOKEN should be sent as the API Authorization header.
- A Hugging Face user needs to fetch model metadata in bulk and sort models by downloads.
- A data engineer needs to read model IDs from stdin, enrich each ID, and emit one NDJSON object per line.
- A developer needs to parse model-card YAML frontmatter for licenses, pipeline tags, or gated-prompt flags.
- A team needs to chain several API calls into a repeatable data-fetching or processing workflow.
What are this skill's strengths and limitations?
- Focused specifically on building scripts for fetching, enriching, and processing Hugging Face API data.
- Supports curl, jq, the hf CLI, and standard-input/output pipelines.
- Explicitly promotes HF_TOKEN authentication for higher limits and appropriate access to data.
- Includes reference patterns for model search, model-card parsing, and NDJSON enrichment.
- Its scope is script construction rather than a complete guide to all Hugging Face Hub operations.
- It requires network access and command-line tools such as curl, jq, or the hf CLI.
- The SKILL.md provides no operating-system-specific setup instructions or test suite.
- The exact API parameters and response shapes must be investigated before finalizing a design.
How do you install this skill?
Copy or symlink the skills/huggingface-tool-builder/ directory from the huggingface/skills repository into a standard Codex .agents/skills location, such as $REPO_ROOT/.agents/skills or the user-level $HOME/.agents/skills. The README does not document a separate installation command for this individual skill; it states that Hugging Face skills can be installed by compatible clients.
How do you use this skill?
In an Agent Skills-compatible coding agent, make a concrete request such as: “Use huggingface-tool-builder to create a script that reads model IDs, fetches metadata from the Hugging Face API, and emits jq-friendly NDJSON.” When authorization is needed, provide HF_TOKEN as an environment variable; the script should include --help and non-destructive behavior should be tested before handoff.
How does this skill compare with similar options?
Compared with hf-cli, this skill focuses more narrowly on creating reusable, composable API tools and data pipelines; the README positions hf-cli as the recommended entry point for core Hugging Face Hub commands.