Install
$ agentstack add skill-fast-agent-ai-skills-hf-static-space-deployer ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
HF Static Space Deployer
Deploy static web content to Hugging Face Spaces in a repeatable way.
Choose the correct deployment mode
Use this skill when the app is static output.
- Plain static files (no build step)
index.html+ CSS/JS files committed directly.- Use
sdk: staticandapp_file: index.html.
- Build-first static app
- Framework source (React/Vite/Svelte/Vue/etc.) requires build.
- Use
sdk: static,app_build_command, andapp_filepointing to built HTML (for exampledist/index.html).
- Do not use this skill when server-side runtime is required
- If the app needs a backend process, custom server routes, or non-static runtime behavior, use Docker Spaces instead.
Minimum required repo structure
At minimum, ensure:
README.mdwith YAML metadata block (includessdk: static).- App entry HTML referenced by
app_file. - Any source/build files needed for build (if using
app_build_command).
See templates in:
- [references/readmetemplates.md](references/readmetemplates.md)
Standard workflow
- Authenticate with Hugging Face.
- Create Space as
repo_type=spaceandspace_sdk=static. - Upload project files.
- Wait for build/startup.
- Validate app URL and behavior.
Use exact commands from:
- [references/deployworkflows.md](references/deployworkflows.md)
Deployment quality checks
After upload/build, verify:
- Space build succeeds.
app_fileexists at expected path.- Site loads at the Space URL.
- Asset paths resolve correctly (no broken CSS/JS).
- If SPA:
- hash routing works directly; history routing may need fallback strategy.
- If query/hash syncing with parent page is required, use Spaces postMessage pattern.
See:
- [references/troubleshooting.md](references/troubleshooting.md)
Security and platform caveats
- Static Spaces run inside an iframe on
huggingface.co/spaces/.... - For static Spaces, variables/secrets are available to browser JS through
window.huggingface.variables. - Do not treat static frontend variables as confidential server-only secrets.
- Cookie behavior can differ from first-party hosting due to iframe constraints.
Use:
- [references/securityandplatformnotes.md](references/securityandplatformnotes.md)
CI/CD guidance
Prefer one of:
- Push directly with
hf upload. - Mirror from GitHub with a GitHub Action that pushes to the Space repo.
Use templates from:
- [references/deployworkflows.md](references/deployworkflows.md)
Local tooling bundled with this skill
scripts/scaffold_static_space.py: generate aREADME.mdmetadata block and optional GitHub Action workflow.scripts/validate_static_space.py: validate local projects and/or existing deployed Spaces (for example--space-id evalstate/foo).
Output expectations
When helping a user, always produce:
- Final
README.mdYAML block. - Exact deploy command sequence.
- Suggested CI option (manual or GitHub Actions).
- Post-deploy validation checklist.
- Troubleshooting steps tailored to framework/output path.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: fast-agent-ai
- Source: fast-agent-ai/skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.