huggingface-paper-publisher

github.com/huggingface/skills
Verdict: Generally safe
0 critical0 high4 medium
B
SCORE 75 / 100
$skillox install huggingface-paper-publisherSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade B?

score · 75 / 100

The current grade reflects 4 medium findings (3+ MEDs → B).

0 CRIT0 HIGH4 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve 2 of 4 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-rcjodm0ipgt2fkna1bx4at46 · Thu, 28 May 2026 17:37:54 GMT · 2ms

med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
med
Link text shows "hf.co" but points at huggingface.co
The visible link text contains the domain `hf.co`, but the URL actually targets `huggingface.co`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 547CWE-601
545### Resources and References
546
547- **Hugging Face Paper Pages**: [hf.co/papers](https://huggingface.co/papers)text→hf.co · href→huggingface.co
548- **Model Cards Guide**: [hf.co/docs/hub/model-cards](https://huggingface.co/docs/hub/en/model-cards)
549- **Dataset Cards Guide**: [hf.co/docs/hub/datasets-cards](https://huggingface.co/docs/hub/en/datasets-cards)
med
Link text shows "hf.co" but points at huggingface.co
The visible link text contains the domain `hf.co`, but the URL actually targets `huggingface.co`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 548CWE-601
546
547- **Hugging Face Paper Pages**: [hf.co/papers](https://huggingface.co/papers)
548- **Model Cards Guide**: [hf.co/docs/hub/model-cards](https://huggingface.co/docs/hub/en/model-cards)text→hf.co · href→huggingface.co
549- **Dataset Cards Guide**: [hf.co/docs/hub/datasets-cards](https://huggingface.co/docs/hub/en/datasets-cards)
550- **Research Article Template**: [tfrere/research-article-template](https://huggingface.co/spaces/tfrere/research-article-template)
med
Link text shows "hf.co" but points at huggingface.co
The visible link text contains the domain `hf.co`, but the URL actually targets `huggingface.co`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 549CWE-601
547- **Hugging Face Paper Pages**: [hf.co/papers](https://huggingface.co/papers)
548- **Model Cards Guide**: [hf.co/docs/hub/model-cards](https://huggingface.co/docs/hub/en/model-cards)
549- **Dataset Cards Guide**: [hf.co/docs/hub/datasets-cards](https://huggingface.co/docs/hub/en/datasets-cards)text→hf.co · href→huggingface.co
550- **Research Article Template**: [tfrere/research-article-template](https://huggingface.co/spaces/tfrere/research-article-template)
551- **arXiv Format Guide**: [arxiv.org/help/submit](https://arxiv.org/help/submit)
View latest scan →
skillox.io/c/huggingface-paper-publisher