Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add waybarrios/opencode-power-pack --skill huggingface-community-evalsgit clone --depth 1 https://github.com/waybarrios/opencode-power-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/waybarrios/opencode-power-pack/huggingface-community-evals)<a href="https://agentmods.dev/skills/waybarrios/opencode-power-pack/huggingface-community-evals"><img src="https://agentmods.dev/badge/skills/waybarrios/opencode-power-pack/huggingface-community-evals/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/waybarrios/opencode-power-pack/huggingface-community-evals"><img src="https://agentmods.dev/badge/skills/waybarrios/opencode-power-pack/huggingface-community-evals.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Data Exfiltration · line 48 Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.Fix: Read only explicitly required environment variables by name. Avoid enumerating or copying the full environment, and never log or transmit credentials to untrusted destinations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.01787 |
| Opus 5 | $0.00036 | $0.00894 |
| Sonnet 5 | $0.00014 | $0.00357 |
| Haiku 4.5 | $0.00007 | $0.00179 |
Grade C, and why
huggingface-community-evals scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
printenv HF_TOKEN >/dev/null How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
This skill is for running evaluations against models on the Hugging Face Hub on local hardware.
It covers:
inspect-aiwith local inferencelightevalwith local inference- choosing between
vllm, Hugging Face Transformers, andaccelerate - smoke tests, task selection, and backend fallback strategy
It does not cover:
- Hugging Face Jobs orchestration
- model-card or
model-indexedits - README table extraction
- Artificial Analysis imports
.eval_resultsgeneration or publishing- PR creation or community-evals automation
If the user wants to run the same eval remotely on Hugging Face Jobs, submit the same script via hf jobs uv run (CLI) or the hf_jobs() MCP tool if configured, for remote GPU execution.
If the user wants to publish results into the community evals workflow, stop after generating the evaluation run and hand that publishing step off to the project's own community-evals workflow.
All paths below are relative to the directory containing this
SKILL.md.
When To Use Which Script
| Use case | Script |
|---|---|
Local inspect-ai eval on a Hub model via inference providers |
scripts/inspect_eval_uv.py |
Local GPU eval with inspect-ai using vllm or Transformers |
scripts/inspect_vllm_uv.py |
Local GPU eval with lighteval using vllm or accelerate |
scripts/lighteval_vllm_uv.py |
| Extra command patterns | examples/USAGE_EXAMPLES.md |
Prerequisites
- Prefer
uv runfor local execution. - Set
HF_TOKENfor gated/private models. - For local GPU runs, verify GPU access before starting:
uv --version
printenv HF_TOKEN >/dev/null
nvidia-smi
If nvidia-smi is unavailable, either:
- use
scripts/inspect_eval_uv.pyfor lighter provider-backed evaluation, or - submit it to Hugging Face Jobs (
hf jobs uv runorhf_jobs()) if the user wants remote compute.
Core Workflow
- Choose the evaluation framework.
- Use
inspect-aiwhen you want explicit task control and inspect-native flows. - Use
lightevalwhen the benchmark is naturally expressed as a lighteval task string, especially leaderboard-style tasks.
- Use
- Choose the inference backend.
- Prefer
vllmfor throughput on supported architectures. - Use Hugging Face Transformers (
--backend hf) oraccelerateas compatibility fallbacks.
- Prefer
- Start with a smoke test.
inspect-ai: add--limit 10or similar.lighteval: add--max-samples 10.
- Scale up only after the smoke test passes.
- If the user wants remote execution, submit the same script + args to Hugging Face Jobs (
hf jobs uv runorhf_jobs()).
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 209 lines · 71 tokens per session scan C 7f8e42105c17
huggingface-community-evals is a skill published in the GitHub repository waybarrios/opencode-power-pack (498 stars, last pushed yesterday), licensed MIT. It adds 71 tokens to every session and 1,787 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
harmonyos-app
HarmonyOS application development expert. Use when building HarmonyOS apps with ArkTS, ArkUI, Stage model, and distributed capabilities. Covers HarmonyOS NEXT (API 12+) best practices.
spring-shell
Spring Shell for building interactive CLI applications. Covers @ShellComponent, @ShellMethod, input validation, tables, and command groups. USE WHEN: user mentions "spring shell", "@ShellComponent", "@ShellMethod", "CLI application Spring", "interactive shell", "command line tool Spring" DO NOT USE FOR: simple scripts…
llm-inference-integration
Use when designing, implementing, reviewing, debugging, or operating LLM, agent, RAG, prompt, model-routing, streaming, evaluation, replay, shadow, token-cost, or batch inference features across backend products. Product-agnostic; do not depend on prior codebase names, paths, providers, or business domains. Triggers…
mode-interactive
The interactive implementation posture (/foundry:mode-interactive) — the default lean direct loop. The operator drives edit→verify→merge in one accountable context; the operator reviews the diff at the merge button (the Regular-mode segregation). Sibling of mode-autonomous; they differ ONLY at the two ends (who paces…
shipkit-prompt-audit
Audit LLM prompt pipeline architecture — decomposition, parallelization, chain integrity, schema validation, fallback paths. Finds structural issues no linter catches.
calendar-provider
Patterns for integrating business calendar providers (Google Workspace, Microsoft 365, Zoho Workplace, business CalDAV). OAuth flow, push subscriptions, echo suppression, etag concurrency, and write-back via the outbox pattern.