disclude.ioPyPI / huggingface-hub / 2.2.0
huggingface-hub 2.2.0
- Source
- https://github.com/huggingface/huggingface_hub
- Tag scanned
v2.2.0- Compared with
v2.1.1(0 signals introduced since)- Files
- 469 scanned, 6 skipped (binary, oversized, or unrecognised)
- Signals
- 0 critical · 123 warn · 127 info
- Scan time
- 101.4 s
- LLM review
- Reviewed by claude-haiku-5-5 (Anthropic): the 117 most severe of 240 warn and critical signals (117 with a verdict); 117 demoted to info. The rest are unreviewed.
- Disclude version
- 4.1.0
- Scanned (UTC)
- 2026-10-22 02:30
Signals
Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
1. 2. -
2. 3. -
-
-
-
* * -
* * -
* -
* -
* -
-
-
-
-
-
- - -
- - -
- - -
- - -
- -
- -
- -
-
-
-
-
-
-
Face Hub ಅಪ್ಲಿಕೇಶನ್⟨U+200C⟩ಗಳನ್ನು ದೃಢೀಕರಿಸಲು ಟೋಕನ್⟨U+200C⟩ಗಳನ್ನು ಬಳಸುತ್ತದೆ (ನೋಡಿ [ದಸ್ತಾವೇಜು](https://huggingface.co/docs/hub/security-tokens)). ನಿಮ್ಮ ಯಂತ್ರದಲ್ಲಿ ಲಾಗಿನ್ … (340 bytes total) -
-
-
-
-
-
- -
- - -
- - -
- - -
- -
- -
- -
- -
ifyToken\":\"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJoYXNoIjoiMDhhNjg5YzNiZGQ1YTIyYTAwZGUwOWEzZTRiYzdjM2QzYjA3ZTUxNDM1NjE1MTUyMjE1MGY1YzEzMjRjYzVjYiIsInZlcnNpb24iOjF9.EH5JJo8EEFwU7osPz3s7qanw_tigeCFhCXjSfyN0Y1nWVnSfulSxIk_DbAEI5iE80V4EKLyp5-mYFodWvL2KDA\"},{\"type\":\"f1\",\"value\":82.9501,\"name\":\"F1\",\"verified\" -
ifyToken\":\"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJoYXNoIjoiMjk5ZDYwOGQyNjNkMWI0OTE4YzRmOTlkY2JjNjQ0YTZkNTMzMzNkYTA0MDFmNmI3NjA3NjNlMjhiMDQ2ZjJjNSIsInZlcnNpb24iOjF9.DDm0LNTkdLbGsue58bg1aH_s67KfbcmkvL-6ZiI2s8IoxhHJMSf29H_uV2YLyevwx900t-MwTVOW3qfFnMMEAQ\"},{\"type\":\"total\",\"value\":11869,\"name\":\"total\",\"verifi -
ifyToken\":\"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJoYXNoIjoiMGFkMmI2ODM0NmY5NGNkNmUxYWViOWYxZDNkY2EzYWFmOWI4N2VhYzY5MGEzMTVhOTU4Zjc4YWViOGNjOWJjMCIsInZlcnNpb24iOjF9.fexrU1icJK5_MiifBtZWkeUvpmFISqBLDXSQJ8E6UnrRof-7cU0s4tX_dIsauHWtUpIHMPZCf5dlMWQKXZuAAA\"}]},{\"task\":{\"type\":\"question-answering\",\"name\":\"Questio -
ifyToken\":\"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJoYXNoIjoiMDhhNjg5YzNiZGQ1YTIyYTAwZGUwOWEzZTRiYzdjM2QzYjA3ZTUxNDM1NjE1MTUyMjE1MGY1YzEzMjRjYzVjYiIsInZlcnNpb24iOjF9.EH5JJo8EEFwU7osPz3s7qanw_tigeCFhCXjSfyN0Y1nWVnSfulSxIk_DbAEI5iE80V4EKLyp5-mYFodWvL2KDA\"},{\"type\":\"f1\",\"value\":82.9501,\"name\":\"F1\",\"verified\" -
ifyToken\":\"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJoYXNoIjoiMjk5ZDYwOGQyNjNkMWI0OTE4YzRmOTlkY2JjNjQ0YTZkNTMzMzNkYTA0MDFmNmI3NjA3NjNlMjhiMDQ2ZjJjNSIsInZlcnNpb24iOjF9.DDm0LNTkdLbGsue58bg1aH_s67KfbcmkvL-6ZiI2s8IoxhHJMSf29H_uV2YLyevwx900t-MwTVOW3qfFnMMEAQ\"},{\"type\":\"total\",\"value\":11869,\"name\":\"total\",\"verifi -
ifyToken\":\"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.eyJoYXNoIjoiMGFkMmI2ODM0NmY5NGNkNmUxYWViOWYxZDNkY2EzYWFmOWI4N2VhYzY5MGEzMTVhOTU4Zjc4YWViOGNjOWJjMCIsInZlcnNpb24iOjF9.fexrU1icJK5_MiifBtZWkeUvpmFISqBLDXSQJ8E6UnrRof-7cU0s4tX_dIsauHWtUpIHMPZCf5dlMWQKXZuAAA\"}]},{\"task\":{\"type\":\"question-answering\",\"name\":\"Questio -
Match\",\"verified\":false},{\"type\":\"f1\",\"value\":82.939,\"name\":\"F1\",\"verified\":false}]}]}],\"base_model\":[\"FacebookAI/roberta-base\"]},\"transformersInfo\":{\"auto_model\":\"AutoModelForQuestionAnswering\",\"pipeline_tag\":\"question-answering\",\"processor\":\"AutoTokenizer\"},\"siblings\":[{\"rf -
warn
encoding-base64tests/cassettes/InferenceApiTest.test_inference_overriding_invalid_task.yaml:40:9X-Amz-Cf-Id: - QYfF2QIo7x2Nqc7z0DJulCrvKxsbjnoa0HJn44f7xPFCmn0J8KXZ5g== X-Amz-Cf-Pop: - CDG52-P4 -
is the [MASK] of France."},{"text":"The goal of life is [MASK]."}],"model-index":null,"config":{"architectures":["BertForMaskedLM"],"model_type":"bert","tokenizer_config":{}},"cardData":{"language":"en","tags":["exbert"],"license":"apache-2.0","datasets":["bookcorpus","wikipedia"]},"transformersInfo":{"auto_mod -
warn
encoding-base64tests/cassettes/InferenceApiTest.test_inference_overriding_invalid_task.yaml:93:20X-Amz-Cf-Id: - pdTj3oTK7I_em8rndxqLMzArrdGyjf0TWg4K55lOjqBIC88u9k0Weg== X-Amz-Cf-Pop: - CDG52-P4 -
person","Today is a sunny day"]}],"model-index":null,"config":{"architectures":["AlbertModel"],"model_type":"albert","tokenizer_config":{"bos_token":"[CLS]","eos_token":"[SEP]","unk_token":"<unk>","sep_token":"[SEP]","pad_token":"<pad>","cls_token":"[CLS]","mask_token":{"content":"[MASK]","single_word":false,"l -
X-Amz-Cf-Id: - 2NNdzWr0gEdSvzElBjXv2GvinessqJ6FucSiK0g1dEqEUAcdUPurgw== X-Amz-Cf-Pop: - CDG52-P4 -
string: '[-0.341085821390152,0.16878847777843475,0.5349205732345581,-0.7717202305793762,0.3694867789745331,0.041570067405700684,-0.22994324564933777,-0.5638588666915894,-0.030669301748275757,-0.299565851688385,-0.8804835081100464,0.16595038771629333,-0.5313254594802856,0.18190892040729523,0.549403965473175,0.4503 -
is the [MASK] of France."},{"text":"The goal of life is [MASK]."}],"model-index":null,"config":{"architectures":["BertForMaskedLM"],"model_type":"bert","tokenizer_config":{}},"cardData":{"language":"en","tags":["exbert"],"license":"apache-2.0","datasets":["bookcorpus","wikipedia"]},"transformersInfo":{"auto_mod -
string: '{"_id":"638f7ae36c25af4071044105","id":"stabilityai/stable-diffusion-2-1","private":false,"pipeline_tag":"text-to-image","library_name":"diffusers","tags":["diffusers","safetensors","stable-diffusion","text-to-image","arxiv:2112.10752","arxiv:2202.00512","arxiv:1910.09700","license:openrail++","autotrain -
string: '{"_id":"638f7ae36c25af4071044105","id":"stabilityai/stable-diffusion-2-1","private":false,"pipeline_tag":"text-to-image","library_name":"diffusers","tags":["diffusers","safetensors","stable-diffusion","text-to-image","arxiv:2112.10752","arxiv:2202.00512","arxiv:1910.09700","license:openrail++","autotrain -
X-Amz-Cf-Id: - _zL1bIJbONpKnGKV11WalfKg3AseDTIy4apS8njN3TF1VHNNm7qBxQ== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - aH7hYCC_MTDl-sikHXAQZwwl8H7ZkAHuU1Raj65PT1M9ZqDdlUMHtg== X-Amz-Cf-Pop: - CDG52-P4 -
- request: body: '{"files": [{"path": "app.py", "sample": "CmltcG9ydCBncmFkaW8gYXMgZ3IKCgpkZWYgZ3JlZXQobmFtZSk6CiAgICByZXR1cm4gIkhlbGxvICIgKyBuYW1lICsgIiEhIgoKaWZhY2UgPSBnci5JbnRlcmZhY2UoZm49Z3JlZXQsIGlucHV0cz0idGV4dCIsIG91dHB1dHM9InRleHQiKQppZmFjZS5sYXVuY2goKQo=", "size": 152}]}' headers: -
X-Amz-Cf-Id: - hATAPZaLcQEsftKG9LsDN0rOcZxEGFk4ndyGXoxsVLxzSaOziI9HLA== X-Amz-Cf-Pop: - CDG52-P4 -
-
X-Amz-Cf-Id: - Pe-v9zhEQlLPUtsJdofOm6Sx2Y4cHG64XD0txMcnixqoCvWQsYUDbw== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - vZ_aoXKkuQAEkCLmr8wT9bEETyAwg7SyUcsugmFzfyjMi2p7fJm0Lw== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - ff4tYN8pDZCRzOyHxiX4htBPouIMsQgaOI8Tu6CXb1ZCv66tOQp40Q== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - wvPMPDDGhrYi1XzKNk6W1yKMnywEDoO7GUutB158Hb6hoA9bDoE2EQ== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - FPgiwymoD902XfsaHSJ5PeBg0cTa0wzCclmMCk4W2oMIlowB5ATzxw== X-Amz-Cf-Pop: - CDG52-P4 -
- request: body: '{"files": [{"path": "app.py", "sample": "CmltcG9ydCBncmFkaW8gYXMgZ3IKCgpkZWYgZ3JlZXQobmFtZSk6CiAgICByZXR1cm4gIkhlbGxvICIgKyBuYW1lICsgIiEhIgoKaWZhY2UgPSBnci5JbnRlcmZhY2UoZm49Z3JlZXQsIGlucHV0cz0idGV4dCIsIG91dHB1dHM9InRleHQiKQppZmFjZS5sYXVuY2goKQo=", "size": 152}]}' headers: -
-
X-Amz-Cf-Id: - xuZonJ3zlvIeaBbYm2gx4mROKU5nvjpWgraQpLXjoAyhRA1XuRnzHw== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - x9C51EPVQRKMu0X9269jE9kRV1TI3E1WxIAvgpzZX4UoGBIQnSmUjg== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - 8bg9Y0pAFQBq9RtFl3WHSGkvOXjwi35BJRm5xLn6s4wzyhg0mhMnKg== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - ajAUhuKkNRQmjXeSetA9dc0TwaMHDX7zIx4nkz8O80cuxYrvqtW5Bg== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - -eXNt-VkjkjAhxHxFRgmHOEgWq0AHNxJ5A7v3ejo1tj6PfHfGs6WRg== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - 3V7eqdB1eXIzDFvSAo4lEw42b3cS46NwFu3TFiTzGa17Pi3g7gbLtA== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - nvIM3SyyDIDQyq6II7z0MYhkPao7GWEuvtbeJGArLb96ivflvXPHQw== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - gp59kY8IyTOe7uOCAPRyk7aqNXqXzjX7YF374voAc3cHzsm4jJzJRA== X-Amz-Cf-Pop: - CDG52-P4 -
X-Amz-Cf-Id: - k3vFxzVrf5jBRs4IIh2ZTzOLk4fpLYBov63R9icnaBQaOtgQJuwwLw== X-Amz-Cf-Pop: - CDG52-P4 -
- request: body: '{"files": [{"path": "app.py", "sample": "CmltcG9ydCBncmFkaW8gYXMgZ3IKCgpkZWYgZ3JlZXQobmFtZSk6CiAgICByZXR1cm4gIkhlbGxvICIgKyBuYW1lICsgIiEhIgoKaWZhY2UgPSBnci5JbnRlcmZhY2UoZm49Z3JlZXQsIGlucHV0cz0idGV4dCIsIG91dHB1dHM9InRleHQiKQppZmFjZS5sYXVuY2goKQo=", "size": 152}]}' headers: -
warn
encoding-base64tests/cassettes/TestSpaceAPIProduction.test_pause_and_restart_space.yaml:154:16X-Amz-Cf-Id: - YZbiyM_Rm3gBuDSprem8uIdDugxCCJzil9NXuGXdSmjYcJzDjSbEpA== X-Amz-Cf-Pop: - CDG52-P4 -
warn
encoding-base64tests/cassettes/TestSpaceAPIProduction.test_pause_and_restart_space.yaml:172:45 -
warn
encoding-base64tests/cassettes/TestSpaceAPIProduction.test_pause_and_restart_space.yaml:216:17X-Amz-Cf-Id: - dFoaB0Y-sS8CnESrd49aWe7jj8pVe0NLvV4M07gn21isBrsUjwrwag== X-Amz-Cf-Pop: - CDG52-P4 -
- request: body: '{"files": [{"path": "app.py", "sample": "CmltcG9ydCBncmFkaW8gYXMgZ3IKCgpkZWYgZ3JlZXQobmFtZSk6CiAgICByZXR1cm4gIkhlbGxvICIgKyBuYW1lICsgIiEhIgoKaWZhY2UgPSBnci5JbnRlcmZhY2UoZm49Z3JlZXQsIGlucHV0cz0idGV4dCIsIG91dHB1dHM9InRleHQiKQppZmFjZS5sYXVuY2goKQo=", "size": 152}]}' headers: -
-
- request: body: '{"files": [{"path": "app.py", "sample": "CmltcG9ydCBncmFkaW8gYXMgZ3IKCgpkZWYgZ3JlZXQobmFtZSk6CiAgICByZXR1cm4gIkhlbGxvICIgKyBuYW1lICsgIiEhIgoKaWZhY2UgPSBnci5JbnRlcmZhY2UoZm49Z3JlZXQsIGlucHV0cz0idGV4dCIsIG91dHB1dHM9InRleHQiKQppZmFjZS5sYXVuY2goKQo=", "size": 152}]}' headers: -
X-Amz-Cf-Id: - sGYTzm-Xp-C72Q4k6RuLfZGzOR0cyAWxAhi1P9DzSbgFSh4zWGZXYg== X-Amz-Cf-Pop: - CDG52-P4 -
-
= assert == -
assert is -
assert is -
-
-
if ; then version_output="" if ; then PYTHON_CMD="" -
# On macOS and Linux. |likely benign A README install instruction that pipes the hf.co install script into bash.Reasoning
The pipeline is the documented one-line installer for the Hugging Face CLI, a common and expected pattern in install docs. Piping to bash is risky in general, but the source is the project's own domain and the context is a standard install instruction.
-
# Step 2: Review the plan file (JSONL format) # Step 3: Apply the plandismissed A documentation example showing `cat` used to view a JSONL plan file.Reasoning
The snippet is a shell prompt line (`>>> cat sync-plan.jsonl`) that displays a file. It is not a redirect, and the path-command-shadow signal misreads it. The AST pass is flagging a documentation example.
-
|likely benign Docs instruction to install the HF CLI by piping the install script to bash.Reasoning
This is the documented Hugging Face CLI installer piped to bash, a standard install instruction in official docs.
-
|dismissed A curl install command misflagged as a PATH-shadow redirect.Reasoning
The snippet is the same curl-to-bash install line. No redirect to a file named `curl` exists; the signal is a parse artifact of the pipeline.
-
|likely benign Docs install command piping the HF install script to bash with an argument.Reasoning
This is the official CLI installer with a flag passed to the script (`-s -- --exclude-skill`), a documented option in ordinary install docs.
-
|dismissed A curl install command misflagged as a PATH-shadow redirect.Reasoning
There is no redirect in the snippet. The curl pipeline is misread as a write to a file named `curl`.
-
dismissed A documentation example for upgrading huggingface_hub with pip.
Reasoning
`>>> pip install -U huggingface_hub` is a normal package install example. The snippet contains no redirect, so the shadow signal is spurious.
-
dismissed A documentation example installing the hf CLI with Homebrew.
Reasoning
`>>> brew install hf` is a standard Homebrew install example with no redirect, so the shadow signal is a false positive.
-
dismissed A quoted Python exception traceback in documentation text.
Reasoning
The snippet is an error message from an httpx timeout, shown in backticks as prose. It is not shell code, so the claim of a runtime-determined command is wrong.
-
# Python package # or standalone DuckDB CLI (Homebrew: macOS/Linux)dismissed A documentation example installing duckdb with pip.Reasoning
`>>> pip install duckdb` is a standard package install example with no redirect. The shadow flag is spurious.
-
# or standalone DuckDB CLI (Homebrew: macOS/Linux)dismissed A documentation example installing duckdb with Homebrew.Reasoning
`>>> brew install duckdb` is a standard Homebrew example with no redirect. The shadow flag is spurious.
-
# Open an SSH session into it # Print the SSH command instead of running itdismissed A documentation example showing an hf jobs ssh command.Reasoning
`>>> hf jobs ssh <job_id>` is a CLI usage example with a placeholder. It has no redirect, and the ssh match is a parse artifact.
-
-
-
|likely benign Installation guide line piping the HF install script to bash.Reasoning
This is the same documented curl-to-bash install instruction for the HF CLI in the installation guide, a common pattern in official docs.
-
likely benign A zero-width space in Hindi documentation prose.
Reasoning
Zero-width spaces inside a Hindi translation are a common artifact of copy-paste or text rendering. The raw pass has a high false-positive rate, and the text itself is ordinary documentation prose.
-
likely benign A zero-width space in Hindi documentation prose.
Reasoning
This is another zero-width space in the same Hindi translation paragraph. It looks like a text-encoding artifact rather than hidden instructions.
-
|likely benign Korean CLI guide line piping the uv install script to sh.Reasoning
This is a documented curl-to-sh install instruction for the uv tool, a widely used install pattern in official docs.
-
|likely benign Docs example showing the official uv install script run with curl piped to sh.Reasoning
The flagged line is a console example in a Korean docs page showing the official uv installer. The path-command-shadow signal fires on a markdown code example, not on code that writes a file named curl. Piping a remote install script to sh is a common but legitimate install instruction here.
-
likely benign Docs example running a Homebrew install command for the hf CLI.
Reasoning
The line is a docs console example running 'brew install hf'. The path-command-shadow signal misreads a shell command in documentation as a PATH hijack. No redirect or file write is present in the snippet.
-
- local: installation title: "ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍"likely benign Odia translated section title in a docs toctree containing a ZWNJ.Reasoning
U+200C is a standard joiner character required for correct Odia script rendering. The title sits inside a translated docs toctree, so the character is ordinary localized text.
-
likely benign Odia translated documentation text containing a ZWNJ.
Reasoning
The ZWNJ appears inside Odia prose, where it is used for correct conjunct and vowel rendering. This is a raw-pass hit on a translated docs page with no executable context.
-
likely benign Odia translated documentation text containing a ZWNJ.
Reasoning
The ZWNJ sits within Odia prose in a translated README-style page. Odia orthography uses ZWNJ, and the raw pass has a higher false-positive rate on such text.
-
likely benign Odia translated documentation text containing a ZWNJ.
Reasoning
The ZWNJ is within ordinary Odia prose in a translated docs page. The character is a legitimate script joiner, not hidden content.
-
likely benign Odia translated documentation text containing a ZWNJ.
Reasoning
The ZWNJ appears in Odia prose in a translated docs page. It is a normal rendering control for the script and has no code or instruction context.
-
likely benign Odia translated documentation text containing a ZWNJ.
Reasoning
The ZWNJ sits within Odia prose in a contributing section of a translated docs page. It is a legitimate script joiner, consistent with the rest of the translation.
-
likely benign Odia translated link text containing a ZWNJ.
Reasoning
The ZWNJ appears in an Odia link label in a translated docs page. Odia text legitimately uses this joiner, and the snippet shows no hidden or executable content.
-
likely benign Odia translated heading containing a ZWNJ.
Reasoning
The ZWNJ is in an Odia heading ('ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍', 'Installation'). The joiner is needed for correct script rendering in translated docs.
-
likely benign Odia translated installation prose containing a ZWNJ.
Reasoning
The ZWNJ appears in Odia instructional prose about installing packages. It is a legitimate script joiner in a translated docs page.
-
likely benign Odia translated installation prose containing a ZWNJ.
Reasoning
The same Odia installation sentence appears again with a ZWNJ used for correct script rendering. Nothing in the snippet is executable or hidden.
-
likely benign Odia translated installation prose containing a ZWNJ.
Reasoning
The ZWNJ is in the same Odia installation prose, a routine translation artifact of the script. There is no sign of obfuscation.
-
likely benign Odia-language installation docs with a zero-width non-joiner used in normal Odia spelling.
Reasoning
The ZWNJ sits inside Odia words such as ଇନ୍⟨U+200C⟩ଷ୍ଟଲ୍, where Odia orthography uses it to control conjunct formation. It is expected in translated Odia prose in a markdown doc, not an injected payload.
-
likely benign Odia translation sentence with ZWNJ in a word like ଇନ୍⟨U+200C⟩ଷ୍ଟଲ୍.
Reasoning
The ZWNJ appears within Odia words in ordinary prose around the huggingface_hub installation advice. This matches Odia script usage and carries no code or executable content.
-
likely benign Odia docs sentence containing a ZWNJ in a translated install word.
Reasoning
The ZWNJ is inside the Odia word ଇନ୍⟨U+200C⟩ଷ୍ଟଲ୍ in a documentation sentence. It is standard Odia orthography and not hidden instructions or obfuscated code.
-
କରିବା ପାଇଁ [ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍ ଯାଞ୍ଚ କରନ୍ତୁ](#ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍-ଯାଞ୍ଚ-କରନ୍ତୁ)।likely benign Odia markdown link text with ZWNJ in a translated heading anchor.Reasoning
The ZWNJ sits inside an Odia anchor/link label, consistent with Odia spelling in a translated heading link. The surrounding markdown is ordinary documentation.
-
likely benign Continuation of an Odia markdown anchor link containing ZWNJ.
Reasoning
Same Odia anchor link with a ZWNJ in the link target and label. This is a normal part of Odia text rendering and not an attack.
-
likely benign Odia heading with a ZWNJ for optional dependencies installation.
Reasoning
The ZWNJ is inside an Odia heading word, consistent with correct Odia orthography in a translated doc.
-
likely benign Odia prose sentence with ZWNJ about unavailable optional features.
Reasoning
The ZWNJ appears in an Odia explanatory sentence about optional features. It is expected orthography and not a concealed instruction.
-
likely benign Odia sentence before a bash install block, with ZWNJ in the text.
Reasoning
The ZWNJ is inside Odia text introducing pip-based optional dependency installs. The surrounding code fence is an ordinary install command block.
-
*likely benign Odia bullet describing fastai/torch dependencies with ZWNJ.Reasoning
The ZWNJ is within Odia descriptive text about framework-specific dependencies. Normal Odia spelling, with no executable or hidden content.
-
*likely benign Odia bullet where the Latin 'lib' is followed directly by the Odia locative suffix ରେ.Reasoning
The token libରେ joins the Latin word 'lib' with the Odia postposition ରେ, which is what happens when translators place Odia suffixes after English code names. It is a cosmetic script mix in prose, not an identifier used in code.
-
likely benign Odia heading for installing from source with a ZWNJ.
Reasoning
The ZWNJ is inside Odia heading text for source installation, consistent with correct Odia orthography in translated docs.
-
likely benign Odia sentence on source installation with ZWNJ.
Reasoning
The ZWNJ appears in an Odia sentence about installing from source, the same text as earlier lines. It is standard Odia spelling in documentation.
-
likely benign Odia release-note sentence with ZWNJ in a word.
Reasoning
The ZWNJ is inside Odia prose about bug-fix releases not yet published. It is normal Odia text and contains no instructions or code.
-
likely benign A ZWNJ character inside Odia prose in a translated markdown installation guide.
Reasoning
U+200C ZWNJ appears inside Odia words in a translated installation guide. Odia orthography uses ZWNJ legitimately to control conjunct and vowel rendering, and the same pattern recurs throughout the prose and anchor text. This is a raw-pass unicode flag on a documentation file with no code or execution context.
-
likely benign A ZWNJ used in Odia word spelling in documentation prose.
Reasoning
ZWNJ within Odia words such as ବ୍ରାଞ୍ଚ୍⟨U+200C⟩ and ଇନ୍⟨U+200C⟩ଷ୍ଟଲ୍ is standard Odia typesetting. The file is a documentation translation, and the flag comes from a raw byte-level pass.
-
likely benign A second ZWNJ inside Odia prose in the same translated installation paragraph.
Reasoning
Same Odia orthographic ZWNJ usage in a translated doc sentence about installing from source and specifying a branch. No hidden instruction or code is involved.
-
likely benign ZWNJ inside Odia text describing testing of unmerged features, before a bash code block.
Reasoning
ZWNJ appears in Odia words inside a sentence describing testing unmerged features. This is normal Odia script usage in a markdown translation, and the code fence after it is ordinary bash.
-
କରିବା ପାଇଁ [ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍ ଯାଞ୍ଚ କରନ୍ତୁ](#ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍-ଯାଞ୍ଚ-କରନ୍ତୁ)।likely benign A ZWNJ within an Odia markdown in-page anchor link.Reasoning
ZWNJ inside the Odia anchor link text and target of a markdown heading link. Legitimate Odia orthography, and the link target is a normal in-page anchor.
-
likely benign A second ZWNJ in the same Odia markdown anchor link.
Reasoning
Repeats the Odia ZWNJ usage in the same anchor link. Consistent with legitimate translated-heading anchors.
-
likely benign A ZWNJ within an Odia markdown section heading.
Reasoning
ZWNJ in an Odia heading ('editable installation') in a translated doc. Standard Odia spelling, no executable or hidden content.
-
likely benign A ZWNJ in Odia text introducing a link to pip editable installs.
Reasoning
Odia prose with ZWNJ followed by a normal pip documentation link. The character is orthographic, and the link points to the official pip docs.
-
likely benign A second ZWNJ in the same Odia sentence referencing pip editable installs.
Reasoning
Same Odia sentence with the same ZWNJ usage and official pip link. No evidence of obfuscation.
-
likely benign A ZWNJ inside Odia prose describing an advanced installation method.
Reasoning
ZWNJ in Odia prose about installation methods and testing code changes. Legitimate orthography in a translated documentation file.
-
likely benign A later ZWNJ in the same Odia paragraph about an advanced installation method.
Reasoning
Further Odia ZWNJ usage in the same paragraph. Consistent with normal translated documentation.
-
likely benign A ZWNJ within an Odia sentence about cloning huggingface_hub locally.
Reasoning
ZWNJ in an Odia instruction to clone a local copy of huggingface_hub, followed by a normal bash block. Orthographic usage with no hidden payload.
-
likely benign A ZWNJ in Odia prose explaining how cloned commands link to the Python library path.
Reasoning
ZWNJ in Odia text explaining that the commands link the cloned folder to the Python library path. This is a documentation sentence using standard Odia orthography, not code or an instruction to an AI.
-
likely benign Odia translation text containing ZWNJ characters in a markdown installation guide.
Reasoning
U+200C in Odia text is a legitimate orthographic character (ZWNJ used for conjunct formation in Odia/Indic scripts). The file is a translated Hugging Face installation doc; no code execution or hidden instruction.
-
likely benign Odia prose in installation docs with ZWNJ inside words.
Reasoning
ZWNJ in Odia prose is standard Indic script typography, not obfuscation, in a documentation file.
-
likely benign Odia translated documentation line with ZWNJ.
Reasoning
Same benign ZWNJ usage in Odia translated documentation text.
-
likely benign Odia prose sentence with ZWNJ in a documentation file.
Reasoning
ZWNJ within Odia words in translated docs; legitimate script rendering.
-
likely benign Odia section heading about conda installation.
Reasoning
ZWNJ in Odia heading text, consistent with normal Odia typography.
-
likely benign Odia prose mentioning conda-forge channel installation.
Reasoning
ZWNJ in Odia prose describing conda-forge; benign translation text.
-
କରିବା ପାଇଁ [ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍ ଯାଞ୍ଚ କରନ୍ତୁ](#ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍-ଯାଞ୍ଚ-କରନ୍ତୁ)।likely benign Odia link text referencing installation check section.Reasoning
ZWNJ within Odia anchor link text and prose in docs; benign.
-
likely benign Odia anchor link fragment with ZWNJ.
Reasoning
Same benign ZWNJ in Odia link anchor within documentation.
-
likely benign Odia heading for installation verification.
Reasoning
ZWNJ in Odia section heading; normal script usage.
-
likely benign Odia instructions to run a verification command.
Reasoning
ZWNJ in Odia instructional prose preceding a bash block; benign documentation.
-
likely benign Odia description of a gpt2 model info command output.
Reasoning
ZWNJ in Odia prose describing expected output; no hidden content.
-
likely benign Odia prose introducing an example output block.
Reasoning
Same benign Odia prose with ZWNJ preceding a text output block.
-
likely benign Odia heading 'Windows limitations' with Latin word plus Odia suffix.
Reasoning
Identifier-like token 'Windowsର' is Latin 'Windows' followed by Odia genitive postposition 'ର', a natural mixed-script word in translated prose, in a heading.
-
likely benign ZWNJ characters in an Odia translation of huggingface_hub installation docs.
Reasoning
ZWNJ inside Odia (Oriya) text is a normal orthographic feature of Indic scripts, used correctly in words like ଏମ୍⟨U+200C⟩ଏଲ୍ and ସିମ୍⟨U+200C⟩ଲିଙ୍କ୍. This is a translated markdown doc from huggingface_hub, not code. Raw pass has high false-positive rate.
-
likely benign ZWNJ within Odia words in the same translated documentation paragraph.
Reasoning
Same ZWNJ use in Odia prose, grammatically expected in conjuncts and compound words; no code or hidden payload.
-
likely benign Latin 'Windows' followed by Odia postposition in translated prose.
Reasoning
Mixing Latin product name Windows with Odia suffix is normal in multilingual prose; it is not an identifier in code and has no spoofing effect.
-
*likely benign ZWNJ in Odia translated doc bullet about cache and symlinks.Reasoning
ZWNJ used as normal Odia orthography within a translated markdown documentation bullet.
-
*likely benign ZWNJ in Odia translated doc bullet about cache and symlinks.Reasoning
Standard ZWNJ orthographic use in Odia prose, no code context.
-
*likely benign ZWNJ in Odia translated doc bullet about cache and symlinks.Reasoning
Standard ZWNJ orthographic use in Odia prose, no code context.
-
Windowsରେ ସିମ୍⟨U+200C⟩ଲିଙ୍କ୍ ସକ୍ରିୟ କରିବା ପାଇଁ ଆପଣଙ୍କୁ ଡେଭଲପର୍ ମୋଡ୍ ସକ୍ରିୟ କରିବାକୁ କିମ୍ବା ନିଜ ସ୍କ୍ରିପ୍ଟଗୁଡ଼ିକୁ ଆଡମିନିଷ୍ଟ୍ରେଟର୍likely benign Mixed Latin/Odia token 'Windowsରେ' in translated installation instructions.Reasoning
Latin 'Windows' attached to Odia text in prose; a natural result of translation, not an identifier or obfuscation.
-
Windowsରେ ସିମ୍⟨U+200C⟩ଲିଙ୍କ୍ ସକ୍ରିୟ କରିବା ପାଇଁ ଆପଣଙ୍କୁ ଡେଭଲପର୍ ମୋଡ୍ ସକ୍ରିୟ କରିବାକୁ କିମ୍ବା ନିଜ ସ୍କ୍ରିପ୍ଟଗୁଡ଼ିକୁ ଆଡମିନିଷ୍ଟ୍ରେଟର୍likely benign ZWNJ in Odia translated Windows symlink instructions.Reasoning
ZWNJ within Odia prose in a documentation paragraph about enabling symlinks on Windows; no code.
-
*likely benign ZWNJ in Odia translated note on file path special characters.Reasoning
ZWNJ as ordinary Odia orthography in a documentation bullet about file path characters.
-
*likely benign ZWNJ in Odia translated note on file path special characters.Reasoning
ZWNJ as ordinary Odia orthography in the same documentation bullet.
-
*likely benign ZWNJ in Odia translated note on file path special characters.Reasoning
ZWNJ as ordinary Odia orthography in the same documentation bullet.
-
Windows ବିଶେଷ ଅକ୍ଷରଗୁଡ଼ିକ ଉପରେ ଅଧିକ କଟକଣା ଲଗାଇଥାଏ, ଯାହା ଫଳରେ ସେହି ଫାଇଲ୍⟨U+200C⟩ଗୁଡ଼ିକୁ Windowsରେ ଡାଉନଲୋଡ୍ କରିବା ସମ୍ଭବ ହୋଇନପାରେ।likely benign ZWNJ in Odia translated note on Windows filename restrictions.Reasoning
ZWNJ in Odia prose describing Windows filename restrictions; ordinary translation orthography in markdown docs.
-
Windows ବିଶେଷ ଅକ୍ଷରଗୁଡ଼ିକ ଉପରେ ଅଧିକ କଟକଣା ଲଗାଇଥାଏ, ଯାହା ଫଳରେ ସେହି ଫାଇଲ୍⟨U+200C⟩ଗୁଡ଼ିକୁ Windowsରେ ଡାଉନଲୋଡ୍ କରିବା ସମ୍ଭବ ହୋଇନପାରେ।likely benign Odia prose in a Hugging Face Hub translated installation guide, with 'Windows' followed by an Odia suffix.Reasoning
The raw-pass finding flags a Latin token 'Windows' directly followed by Odia script ('Windowsରେ'). This is ordinary Odia translation text where the English product name takes a native locative suffix. It is a documentation string, not an identifier used in code, so the mixed-script signal is a false positive.
-
likely benign A ZWNJ inside Odia prose in a translated markdown documentation file.
Reasoning
A zero-width non-joiner (U+200C) in Odia text is a required orthographic feature for correctly rendering conjuncts and suffixes. It appears in a markdown translation of the huggingface_hub docs, with no code execution or hidden-content role.
-
likely benign A ZWNJ in Odia prose within the translated installation guide.
Reasoning
Same as the other ZWNJ hits: standard Odia orthography in translated documentation prose, consistent with legitimate Unicode text shaping rather than concealment.
-
likely benign A ZWNJ within Odia link text in translated markdown docs.
Reasoning
The ZWNJ sits inside Odia link text in a markdown documentation file. Odia uses ZWNJ for conjunct and suffix rendering, so this is normal text, not hidden payload.
-
likely benign A ZWNJ in Odia link text in the translated installation guide.
Reasoning
The ZWNJ appears in Odia prose inside a link label, which matches standard Odia orthography in this translated documentation.
-
likely benign A ZWNJ inside Odia descriptive text in the translated quick-start guide.
Reasoning
A ZWNJ within Odia prose in a translated quick-start document. This is expected orthography for Odia, and the surrounding text is ordinary documentation.
-
likely benign A ZWNJ in Odia prose in the translated quick-start guide.
Reasoning
Standard Odia orthographic ZWNJ in translated documentation prose. The snippet shows no code, encoded data, or instruction hidden from readers.
-
likely benign A ZWNJ within an Odia markdown section heading in the quick-start guide.
Reasoning
The ZWNJ is in an Odia section heading ('ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍'), where it is the normal way to write the transliterated word 'installation'. It is ordinary documentation text.
-
likely benign A ZWNJ in Odia instructional text before a shell code fence in the quick-start guide.
Reasoning
The ZWNJ appears in Odia instructional prose preceding a bash code block. The character is part of normal Odia spelling and does not alter the executed command.
-
likely benign A ZWNJ in Odia link text and prose in the quick-start guide.
Reasoning
The ZWNJ is inside Odia prose and a link label ('ଇନ୍⟨U+200C⟩ଷ୍ଟଲେସନ୍' as a relative link text). This is standard Odia spelling in translated documentation.
-
likely benign A ZWNJ in Odia section text in the translated quick-start guide.
Reasoning
The ZWNJ is in Odia section and prose text in translated docs, consistent with normal orthography. Nothing is hidden or executed.
-
likely benign A ZWNJ in an Odia section heading in the quick-start guide.
Reasoning
A ZWNJ in an Odia markdown section heading ('ଫାଇଲ୍⟨U+200C⟩ଗୁଡ଼ିକ ଡାଉନଲୋଡ୍ କରନ୍ତୁ'). This is ordinary Odia orthography in translated documentation.
-
likely benign A ZWNJ in Odia prose describing Hub repositories in the quick-start guide.
Reasoning
The ZWNJ occurs in Odia prose describing git-versioned repositories. It is standard Odia spelling in a translated documentation file, with no sign of concealment.
-
dismissed A ZWNJ character appears inside a translated Odia sentence in the Hugging Face quick-start docs.
Reasoning
The raw pass flags a ZWNJ inside Odia (Oriya) prose in a Hugging Face documentation file. ZWNJ is a normal orthographic control character in Odia and other Indic scripts, used to block unwanted conjunct formation. The surrounding text is an ordinary translated documentation sentence with no code or execution context.
-
dismissed A ZWNJ character appears within an Odia word in the translated quick-start docs.
Reasoning
The raw pass flags a ZWNJ in an Odia word inside a markdown doc. This is standard Odia orthography in translated prose, not hidden content or a steering payload.
-
dismissed A ZWNJ character appears in an Odia paragraph about repository IDs and filenames in the docs.
Reasoning
The same ZWNJ-in-Odia-prose pattern recurs in a legitimate translated documentation paragraph. It is a linguistic rendering feature with no malicious or hidden-text character.
-
dismissed A second ZWNJ on the same Odia documentation line, in ordinary prose about downloads.
Reasoning
A second ZWNJ on the same Odia documentation line is consistent with normal Odia orthography. The line is ordinary prose describing file download parameters.
-
dismissed A ZWNJ in an Odia sentence introducing a Pegasus config download example in the docs.
Reasoning
The ZWNJ sits inside an Odia sentence that links to a Pegasus model page and introduces a code block. The character is orthographic and the surrounding content is benign documentation.
-
dismissed A ZWNJ in an Odia paragraph about specifying file revisions in the docs.
Reasoning
The ZWNJ appears in an Odia paragraph about specifying file revisions. This is standard Odia text in translated documentation with no hidden instruction or code execution.
-
dismissed A ZWNJ in an Odia sentence about Hugging Face account authentication in the docs.
Reasoning
The ZWNJ is inside a translated Odia sentence about authentication with a Hugging Face account. It is normal orthography, and the sentence is ordinary documentation.
-
dismissed A ZWNJ in an Odia list of repository actions in the docs.
Reasoning
The ZWNJ appears in an Odia list of repository actions. This is linguistic rendering in benign translated documentation.
-
dismissed A ZWNJ in an Odia sentence linking to Hugging Face signup and token settings.
Reasoning
The line is Odia prose with links to Hugging Face signup and token pages. The ZWNJ is orthographic, and the links are ordinary documentation references.
-
dismissed Another ZWNJ on the Odia line about obtaining a user access token.
Reasoning
The same line contains further ZWNJ characters in Odia text next to standard documentation links. Nothing indicates concealment or malicious intent.
-
dismissed A ZWNJ in an Odia sentence explaining User Access Token authentication.
Reasoning
The ZWNJ is in an Odia sentence about using a User Access Token for authentication. This is ordinary translated documentation with normal Indic-script orthography.
-
dismissed A ZWNJ in an Odia blockquote explaining token read and write permissions.
Reasoning
The ZWNJ is in an Odia blockquote about token read and write permissions. It is normal orthography in benign documentation, with no hidden content.
-
dismissed A zero-width non-joiner inside Odia-language documentation prose.
Reasoning
U+200C is used in Odia text as a standard joiner/non-joiner for conjunct and vowel-sign rendering. It appears inside ordinary Odia prose in a docs file, and the raw pass has a high false-positive rate for this pattern.
-
dismissed A zero-width non-joiner inside Odia-language documentation prose.
Reasoning
The ZWNJ sits within Odia words in normal documentation text, consistent with correct Odia orthography. No hidden instruction or payload is present.
-
dismissed A zero-width non-joiner inside Odia-language documentation prose.
Reasoning
The ZWNJ is part of normal Odia word forming in a documentation sentence. It carries no hidden content.
-
dismissed A zero-width non-joiner in an Odia sentence that introduces a bash login command.
Reasoning
The ZWNJ appears in an Odia sentence introducing the login command. This is standard script usage and not an obfuscation technique.
-
dismissed A zero-width non-joiner inside Odia documentation text about login and token behaviour.
Reasoning
The ZWNJ is embedded in Odia words in a documentation paragraph describing token storage. The surrounding text is ordinary explanatory prose.
-
dismissed A zero-width non-joiner inside Odia documentation text about token storage.
Reasoning
The ZWNJ is standard Odia orthography in a documentation sentence. The sentence describes saving the token and has no hidden directives.
-
string: "{\"_id\":\"621ffdc136468d709f17a5fd\",\"id\":\"deepset/roberta-base-squad2\",\"private\":false,\"pipeline_tag\":\"question-answering\",\"library_name\":\"transformers\",\"tags\":[\"transformers\",\"pytorch\",\"tf\",\"jax\",\"rust\",\"safetensors\",\"roberta\",\"question-answering\",\"en\",\"dataset:squad -
string: '{"_id":"621ffdc036468d709f174338","id":"google-bert/bert-base-uncased","private":false,"pipeline_tag":"fill-mask","library_name":"transformers","tags":["transformers","pytorch","tf","jax","rust","coreml","onnx","safetensors","bert","fill-mask","exbert","en","dataset:bookcorpus","dataset:wikipedia","arxiv -
string: '{"_id":"621ffdc136468d709f1802e8","id":"sentence-transformers/paraphrase-albert-small-v2","private":false,"pipeline_tag":"sentence-similarity","library_name":"sentence-transformers","tags":["sentence-transformers","pytorch","tf","rust","onnx","safetensors","openvino","albert","feature-extraction","senten -
string: '{"_id":"621ffdc036468d709f174338","id":"google-bert/bert-base-uncased","private":false,"pipeline_tag":"fill-mask","library_name":"transformers","tags":["transformers","pytorch","tf","jax","rust","coreml","onnx","safetensors","bert","fill-mask","exbert","en","dataset:bookcorpus","dataset:wikipedia","arxiv -
info
critical→ info by reviewdynamic-executionutils/_legacy_check_future_compatible_signatures.py:189:9= returnlikely benign A repository maintenance script that spawns a located ruff binary to fix a file.Reasoning
The script runs a ruff binary located by find_ruff_bin() with a fixed argument list to auto-fix a file. This is a developer repository utility, and the spawned tool is the expected linter. The non-literal path is a routine way to locate a tool.
-
= returnlikely benign A repository utility that runs ruff check and format on a source file.Reasoning
The script spawns ruff check and ruff format on a repository file via a binary path from find_ruff_bin(). This is ordinary lint and format tooling in a utils directory with no network or hidden behaviour.
-
returnlikely benign A repository utility that runs ruff format on a source file.Reasoning
This is the second ruff format invocation in the same benign linting helper. Its arguments are fixed and the target is a repository file.
-
if [; then -
-
# Fail early with guidance when python lacks the venv module if ! ; then case "" in -
-
if ! ; thenlikely benign An installer that runs the freshly installed hf CLI to add a skill.Reasoning
The installer runs the hf binary it has just placed in BIN_DIR to add a skill. Executing the program it installed is expected behaviour. The BIN_DIR variable is set from a path-resolution command, which is a common installer pattern rather than an obfuscated dropper.
-
# Test the CLI if ; thenlikely benign An installer that runs hf version to verify the CLI it just installed.Reasoning
The installer tests the hf binary it installed in BIN_DIR using the version command. This is a standard post-install check and does not fetch or run remote code.
-
elselikely benign An installer that prints the installed hf CLI version.Reasoning
The script captures the output of the installed hf version command to display the current version. This is a benign status display in an installer. The variable-command pattern reflects installation location, not a hidden payload.
Reproduce This Scan
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
&&