Check H11 · execution family · severity INFO · automatic · one of the 18 Hugging Face checks
The question this check asks: is this repository a Hugging Face Space — the one kind of Hugging Face repository whose entire purpose is to run code the instant someone opens it?
Before anything else: this is not a finding against the repository. It's telling you what kind of repository this is.
Spaces are Hugging Face's app-hosting product. A Space is a Gradio or Streamlit application, a Docker container, or a static site, and the Hub runs it the moment a visitor opens the page — there is no separate "load" step the way there is for a model's weights or a dataset's load_dataset() call. That makes a Space categorically different from a model or dataset repository, and it's why H11 exists purely as a classification signal: everything downstream of "you are looking at an app" — what the app's own code actually does, whether it embeds an agent-config backdoor, whether it phones home — is the job of other checks, run against the Space's own files exactly as they would run against any repository's.
H11 also sits outside all four of RepoGates' dimension verdicts — open in an editor (H9, H14–H17), clone (H1–H5, H12), install and run (H6–H10, H13), and hand to an AI agent (H9, H14–H18). Being a Space isn't itself evidence for any one of those specific risks; it's a category label the other checks then apply themselves to.
H11 reads the repository's kind from the Hub's own metadata. When it is a Space, the finding hf-space-executes fires at INFO, costing 0 points. The evidence note in the scoring table:
“scope note, not a fault”
Because it costs nothing, H11 never moves the score and never determines a verdict by itself. A Space with an otherwise completely clean roster still scores 100, exactly as a model or dataset would. Verdict math across all 18 checks is the same engine regardless: any CRITICAL finding zeroes the score and reads BLOCK outright; otherwise the score starts at 100 and each fired finding's points are subtracted, floored at 0, graded green (PASS, ≥ 80), amber (REVIEW, 50–79) or red (BLOCK, < 50 or any CRIT). H11 never contributes a point to that subtraction.
There isn't a false-positive rate to report in the ordinary sense. H11 fires on every Space, without exception, whether it's a well-maintained demo with tens of thousands of visitors or a throwaway upload from an hour ago — that is by design, not a defect to be measured. The honest statement here is simply that a 100% fire-rate on Spaces is exactly what H11 is supposed to do.
H11 says nothing about what the Space's own code does. A clean H11 result tells you the repository is a Space — that's all. Whether its app.py requests unusual permissions, reaches out to an unexpected host, or embeds an agent-config file with a hidden instruction is the job of H9 and the agent-surface checks (H14–H17), run against the Space's files the same way they'd run against a model repository's.
It also says nothing about the Space's runtime behaviour once it is live on Hugging Face's own infrastructure — that is entirely outside what a download gate can ever reach. And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: the Space's page shows its sdk — gradio, streamlit, docker or static — either directly on the page or in the README's YAML front-matter. With the API:
curl https://huggingface.co/api/spaces/OWNER/NAMEand read the sdk field returned. Note that even a static Space can execute JavaScript client-side the moment you open it — "not a Gradio server process" does not mean "nothing runs," it just means the execution happens in your browser instead of on Hugging Face's servers.
Does H11 mean this Space is dangerous? No — it never costs a point and never appears as a warning. It fires because Spaces are Hugging Face's app-hosting product: opening one runs an app by design. It's telling you what you're looking at, not what's wrong with it.
Why does a model or dataset repository never trigger H11? Because only Spaces execute on open by design — a model's weights and a dataset's loading script both need an explicit load step first, which is H6–H10's territory, not H11's.
Does RepoGates stop a malicious Space from running? Not on its own — H11 is informational only. The execution- and agent-surface checks applied to the Space's own files, plus the browser download gate on its code, are what actually assess risk; the Space running live is outside a download gate's reach.
H9 Custom code on load — the model-repository equivalent of "code runs when you use it normally" · H14 Agent config files — the agent-surface checks that run on a Space's files exactly as they would on any repository · H16 MCP shell-launch config — worth checking directly on any Space an agent might be pointed at.
Add RepoGates to Chrome Pricing
Numbers on this page: RepoGates' Hugging Face scoring tables (backend/repotriage/hf/catalogue.py, backend/policy/scoring.json) and the four dimension definitions they feed.