agentic-actions-audito…
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use…
Build and publish a Gradio Hugging Face Space for a user-provided image or video LoRA, including pipeline selection and model-card settings. Use for LoRA demos; use huggingface-spaces for general Space work.
$ npx -y skills add waybarrios/opencode-power-pack --skill huggingface-lora-space-builder --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/huggingface-lora-space-builderContext preview
The summary Claude sees to decide when to auto-load this skill.
Build and publish a Gradio Hugging Face Space for a user-provided image or video LoRA, including pipeline selection and model-card settings. Use for LoRA demos; use huggingface-spaces for general Space work.
name: huggingface-lora-space-builder description: "Build and publish a Gradio Hugging Face Space for a user-provided image or video LoRA, including pipeline selection and model-card settings. Use for LoRA demos; use huggingface-spaces for general Space work." license: Apache-2.0 (modified; see UPSTREAMS.json)
Build and publish a Gradio demo on Hugging Face Spaces that runs inference with a user-provided LoRA. Use whenever someone asks to create, generate, ship, or publish "a Space", "a demo", "a Gradio app", or "a playground" for a LoRA — whether the base model is Qwen-Image, Qwen-Image-Edit, LTX, or another diffusion model. Also use when someone describes a LoRA they trained or hosts on the Hub and wants to share it. The default target is ZeroGPU hardware and the default inference library is `diffusers` when the base model supports it.
The output is a real, published Space (private by default) that the user can try in the browser, not a local script.
The demo should feel handcrafted for this specific LoRA, not a generic template with the LoRA bolted on. Two LoRAs that share a task can still need different demos: a pose-control video LoRA and an outpainting video LoRA both take video in and produce video out, but the inputs the user provides, the preprocessing, and the controls are completely different. Recognizing that is the central job here.
Concretely, a good demo:
Work through these phases in order. Information gathered in one phase decides the next.
1. Gather the LoRA info needed to pick a pipeline and design a UI. 2. Pick the base pipeline and inference recipe. 3. Design the UI for this specific LoRA's task and inputs. 4. Write `app.py`, `requirements.txt`, and `README.md` together; show all three to the user for one batched approval. 5. Publish the Space (private).
Don't drip-feed questions across multiple turns. Batch them.
---
Required: a LoRA repo on the Hub (e.g. `username/my-lora`).
**First, try to read the repo without a token.** If it succeeds, the repo is public — proceed. If it fails with 401/403, the repo is private/gated and you need an authenticated session to read it. **Don't immediately ask for a token.** Check first whether the user is already authenticated.
from huggingface_hub import HfApi, get_token
cached_token = get_token() # picks up HF_TOKEN env var or cached CLI login
if cached_token:
try:
info = HfApi().whoami(token=cached_token)
username = info["name"]
# info also has fine-grained token scope info if applicable
except Exception:
cached_token = None # token exists but is invalid/expiredThen:
When asking for a token (and only when you actually need to ask):
> I need a Hugging Face access token with **write** scope (to read the LoRA if it's private/gated, and to publish the Space). Create one at https://huggingface.co/settings/tokens. Paste it here.
The same token will be reused for publishing in the final phase, so this is a one-time ask.
**Then read what's in the repo:**
**From the model card, try to determine:**
**When something can't be inferred, ask the user — once, in a single batched message.** Format the question to make answering triv
54 rigorous skills for Codex, OpenCode, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more.
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use…
Audit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate…
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future…
Operational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair…
Design a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive…
Deeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and…