Check H14 · agent family · severity HIGH · automatic · one of the 18 Hugging Face checks
The question this check asks: does this Hugging Face model, dataset or Space ship files that an AI coding agent will load at the start of a session and obey — before you have read them, and with no visual difference from anything the repository's author wrote?
H14 is the same detection function as GitHub's C18, pointed at a different file list. Every repository on the Hub — model, dataset or Space — is a git repository underneath, and the Hub's own API exposes its full file tree the same way GitHub's git/trees endpoint does. CLAUDE.md, AGENTS.md, .cursorrules, .cursor/rules/*.mdc, .clinerules, .windsurfrules, .github/copilot-instructions.md, and the MCP and settings files under .mcp.json, .cursor/ and .claude/ are auto-loaded at session start and treated with near-system-prompt authority by any agent working in that checkout — a Space you cloned to develop locally, or a model or dataset repository you opened to write a training script against. The Cloud Security Alliance's ReadSecBench measured what that authority means in practice: direct commands planted in repository text succeeded about 84% of the time, instructions two hops removed about 91%, and 93% of human reviewers missed the embedded attacks. Those numbers describe the agent's behaviour, not the platform it is reading from, so they hold exactly as written whether the file arrived over git clone from GitHub or huggingface_hub from the Hub.
H14 reads the repository's file list — keyed internally as hf/model/ORG/NAME, hf/dataset/ORG/NAME or hf/space/ORG/NAME — and, for each of the same filenames C18 already reads, fetches its contents through the Hub's contents API. Each file is a row at severity HIGH with the note “auto-loaded by AI coding agents at session start — read before agent-ing”, and each row costs 0 points, the same weight C18 carries on GitHub for the same reason: on GitHub, Phase 0 controls found 77 of the 80 most popular repositories ship one of these files, which demoted bare presence from a HIGH-weighted row to a zero-point one — presence alone stopped being a signal. H14 inherits that weight rather than re-deriving it, because it is the identical question asked of a different file list. The scoring engine's evidence note for H14–H17 as a group: “same functions/penalties as C18–C21 (agent-config, hidden-unicode, mcp-exec, credential-redirect) — reuse those check pages' scoring language, applied to the HF file list instead of the GitHub one.” A repository whose only H-finding is H14 therefore reads REVIEW on the board with a score of 100: the weight lives in H15 (45 points) and H16 (30 points), the checks that read what is inside the files this one names.
Not applicable in the usual sense — the row fires on every repository that has such a file, and this is a zero-point HIGH row for exactly that reason. What the 12 September 2026 measurement of the top 100 most-downloaded models does not do is isolate this specific row's fire rate: because it costs nothing, it cannot move a verdict from PASS to REVIEW or REVIEW to BLOCK, so it was not named as a driver of any of the 28 REVIEW rows the way H7 (4 times) and H8 (14 times) were. We say that plainly rather than claim a number the measurement did not produce.
It reads the files on its list. A model card that tells an agent what to do in ordinary prose is not an agent config file and is not read here — the ReadSecBench numbers above are about instructions embedded in text an agent treats as ambient context, not only in files with these specific names, and ordinary readable prose is exactly the case no filename-based check catches. An instruction file under a name we do not know is not read until an extension update adds it. Your agent's own global configuration, outside the repository, is never seen. And presence is all this row reports: what the files say is the job of H15 and H16, and a file that contains a harmful instruction in ordinary visible text passes both.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, huggingface_hub, or fetches made by AI agents outside the browser; a Python from_pretrained() call is never a shell line any hook sees. It does not see the agent read the file; it sees the file before the download. This page, like every check page, exposes no globals a script running on it could read.
Without installing anything: open the repository's Files tab on huggingface.co and look at the root and at .cursor/, .claude/ and .github/ for the names above, and read each one in full before you open an agent in the checkout. With the Hub's own API:
curl -s https://huggingface.co/api/models/ORG/NAME \
| jq -r '.siblings[].rfilename' \
| grep -E '^(CLAUDE\.md|AGENTS\.md|\.cursorrules|\.clinerules|\.windsurfrules|\.github/copilot-instructions\.md|\.cursor/rules/.*\.mdc|\.mcp\.json|\.cursor/mcp\.json|\.claude/.*\.json)$'Swap models for datasets or spaces in the URL for those repository kinds. Then read whatever the grep returns the way you would read a shell script someone handed you: as instructions that will be followed.
Why does a model, dataset or Space even have agent config files? Because every repository on the Hub — models, datasets and Spaces alike — is a git repository underneath, and a Space in particular is often developed the same way a GitHub project is: cloned locally, opened in an editor, worked on with an AI coding agent in the loop. Anything that repository ships, including a CLAUDE.md or an .mcp.json, is auto-loaded by that agent exactly as it would be on GitHub.
So what is the finding for, if it costs nothing? It names the files, so you know what an agent will read before you do, and it is the input to the checks that read the contents: H15 hidden Unicode and H16 MCP shell-launch config carry the weight — 45 and 30 points. Presence is the pointer; content is the signal, exactly as it is on GitHub's C18.
Does RepoGates stop a git clone or huggingface_hub download of this repository? No. RepoGates gates browser-initiated downloads only. It does not see git clone, huggingface_hub, huggingface-cli, curl, or a Python from_pretrained() call — none of those is a browser download, and none of them is a shell line any hook watches either.
H15 Hidden Unicode in agent rules — what is inside the file that a reviewer cannot see · H16 MCP shell-launch config — a command in the file that fetches and runs · H18 AI-agent provenance — a repository carrying instructions for an agent, and (once it ships) surfaced by one · C18 Agent config files (GitHub) — the same function, reading a git tree instead of the Hub's file list.
Add RepoGates to Chrome Pricing
Numbers on this page: Cloud Security Alliance, ReadSecBench (success and reviewer-miss rates, as cited in the repository vetting standard); GitHub Phase 0 controls of 2026-08-14 (77 of 80 popular repositories, the basis for the shared zero-point weight); the 12 September 2026 measurement of the top 100 most-downloaded Hugging Face models (0 BLOCK, 28 REVIEW, 72 PASS), published on the malicious models intelligence page; weights from the product's scoring table.