Skills
Hugging Face LLM Trainer
by Hugging Face
Fine-tune language and vision models with TRL or Unsloth on Hugging Face Jobs, with no local GPU needed.
Our verdict
We have not reviewed Hugging Face LLM Trainer yet
No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.
From the listing
About Hugging Face LLM Trainer
Hugging Face's official training skill (upstream name huggingface-llm-trainer). It runs SFT, DPO, GRPO and reward model training with TRL or Unsloth on Hugging Face Jobs cloud GPUs, and covers dataset preparation and validation, hardware choice, cost estimates, Trackio monitoring, Hub authentication, saving the model to the Hub and GGUF conversion for local use.
Best for
Developers fine-tuning open models without their own GPU setup
Use cases
- Fine-tune an open model on your own instruction data
- Run a DPO or GRPO training job without owning GPUs
- Convert a trained model to GGUF for local inference
Notes
Why it matters
Fine-tuning used to start with renting and configuring GPUs. This skill runs the job on managed infrastructure and guides the dataset and cost choices along the way.
Source
- Skill file: skills/huggingface-llm-trainer/SKILL.md in huggingface/skills.
- Repository: 11,208 GitHub stars, Apache-2.0 licence. Checked 24 Oct 2026 through the GitHub API.
- Last change to the skill: 6 Jul 2026.
- This page was written from the skill's own SKILL.md. It is not an Enterprise DNA source review and the skill has not been installed or tested by us.
Pros
- Official Hugging Face skill
- Covers cost estimation and hardware choice
- Results saved to the Hub automatically
Cons
- Hugging Face Jobs is a paid service
- Licence terms are in a separate file
Key facts
What we have checked
Not checked yet. Dated facts such as prices, releases and repository activity appear here once we have confirmed them from a source.
Health and security
Is Hugging Face LLM Trainer looked after, and what do its setup files show
Security check static checks
40 out of 100
- High HuggingFace transformers vulnerable to remote code execution (affects transformers 4.57.3, pinned in skills/huggingface-llm-trainer/scripts/unsloth_sft_example.py).
- High huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path (affects transformers 4.57.3, pinned in skills/huggingface-llm-trainer/scripts/unsloth_sft_example.py).
- High Hugging Face Transformers downloads custom generation code before trust consent (affects transformers 4.57.3, pinned in skills/huggingface-llm-trainer/scripts/unsloth_sft_example.py).
- High Transformers save_pretrained path traversal allows arbitrary file writes through chat template names (affects transformers 4.57.3, pinned in skills/huggingface-llm-trainer/scripts/unsloth_sft_example.py).
- Medium HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class (affects transformers 4.57.3, pinned in skills/huggingface-llm-trainer/scripts/unsloth_sft_example.py).
- Medium Advisory (affects transformers 4.57.3, pinned in skills/huggingface-llm-trainer/scripts/unsloth_sft_example.py).
- Note 13 of 15 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.
Sources
Where this comes from
No sources recorded yet. Each source we check is listed here with the date we checked it.
A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.
Changelog
What changed
Security finding
Security finding
Security finding
Security finding
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.