Skip to content
Back to skills

Smolagents

ASecurity

"Build, debug, and operate Hugging Face smolagents agents, tools,

  • 247 stars
  • 0 votes
  • 0 copies
  • 3 views
  • Added September 9, 2026
toolspythonbashrailsdockerazuredebuggingapi

Works with

  • cli
  • api
  • mcp

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 20 files and shows the line behind each finding

Scanned September 9, 2026

npx -y skills add VectorSpaceLab/AREX-Skill --skill smolagents --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Smolagents?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Smolagents
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/vectorspacelab-smolagents/badge)](https://www.skillsdirectory.com/skills/vectorspacelab-smolagents)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: smolagents
description: "Build, debug, and operate Hugging Face smolagents agents, tools,
  model providers, secure executors, CLIs, and UI workflows with self-contained
  references and helpers."
disable-model-invocation: true
metadata:
  disco-role: operating
license: Apache 2.0
---

# smolagents

Use this skill when working with Hugging Face `smolagents`: code-writing agents, tool-calling agents, custom tools, model provider wrappers, secure Python execution, command-line entry points, or Gradio/browser UI workflows.

## Quick Start

Install only the extras needed for the route you are using:

```bash
pip install smolagents
pip install "smolagents[toolkit]"   # web search and webpage tools
pip install "smolagents[openai]"    # OpenAI-compatible client support
pip install "smolagents[litellm]"   # LiteLLM provider routing
pip install "smolagents[gradio]"    # Gradio UI helpers
pip install "smolagents[vision]"    # webagent browser automation stack
```

Minimal import and agent shape:

```python
from smolagents import CodeAgent, InferenceClientModel

model = InferenceClientModel()
agent = CodeAgent(tools=[], model=model)
result = agent.run("Summarize the task and return final_answer.")
```

## Route by Task

- Use `sub-skills/agent-workflows/SKILL.md` for `CodeAgent`, `ToolCallingAgent`, `MultiStepAgent`, planning, memory, callbacks, managed agents, serialization, streaming, final-answer checks, and run debugging.
- Use `sub-skills/tools-and-integrations/SKILL.md` for `Tool` subclasses, `@tool`, schemas, validation, built-in tools, Hub/Space/LangChain/MCP integrations, and tool troubleshooting.
- Use `sub-skills/model-providers/SKILL.md` for `InferenceClientModel`, `LiteLLMModel`, `OpenAIModel`, Azure, Bedrock, Transformers, MLX, vLLM, custom `Model` subclasses, credentials, and provider-specific errors.
- Use `sub-skills/execution-and-safety/SKILL.md` for `executor_type`, `LocalPythonExecutor`, authorized imports, `PythonInterpreterTool`, Docker/E2B/Modal/Blaxel execution, sandboxing, and secure-code troubleshooting.
- Use `sub-skills/cli-and-ui/SKILL.md` for `smolagent`, `webagent`, interactive mode, CLI model/tool flags, `GradioUI`, `launch_gradio_demo`, server patterns, and browser UI failures.

## Common Decisions

- Prefer `CodeAgent` when the model should write Python actions and maintain state through a Python executor.
- Prefer `ToolCallingAgent` when the model natively emits tool calls and you need structured tool invocation or parallel tool calls.
- Start with hosted `InferenceClientModel` for the smallest setup; switch to `OpenAIModel`, `LiteLLMModel`, or local wrappers only when the deployment requires it.
- Keep `additional_authorized_imports` narrow; route broad filesystem, network, browser, or service tasks through the execution-and-safety guidance before enabling imports or remote executors.
- Validate tools and model configuration locally before running live providers, browsers, Hub operations, or remote executors.

## Shared References

- Read `references/install-and-extras.md` for package extras, optional dependencies, CLI availability, and verification commands.
- Read `references/troubleshooting.md` for cross-cutting install/import, credential, optional dependency, CLI/API misuse, and workflow-routing failures.
- Read `references/repo-provenance.md` when deciding whether this skill is stale relative to a newer smolagents checkout.

## Shared Scripts

- Run `python scripts/smoke_smolagents_install.py --help` to see the safe checks.
- Run `python scripts/smoke_smolagents_install.py` after installation to verify import metadata, core constructors, and `smolagent --help` without calling external providers.
- Add `--check-webagent` only when the `vision` extra is expected; failure usually means `helium`/browser dependencies are missing.

## Guardrails

- Do not hardcode API keys in examples, serialized tools, CLI invocations, or config files; read them from environment variables or secret managers.
- Do not install `smolagents[all]` by default; choose the narrow extra for the selected provider, tool, UI, or executor.
- Do not instruct users to run original repository examples or tests from this skill. Use the bundled references and scripts here as the reusable runtime source.
- Treat network, browser automation, remote sandboxes, Hub pushes, and model calls as opt-in operations requiring credentials, services, or optional packages.

Files in this skill

  • SKILL.md4.3 KB
  • references/install-and-extras.md2.9 KB
  • references/repo-provenance.md2.8 KB
  • references/repo-routing-metadata.json498 B
  • references/troubleshooting.md3.6 KB
  • scripts/smoke_smolagents_install.py3.8 KB
  • sub-skills/agent-workflows/SKILL.md2.7 KB
  • sub-skills/agent-workflows/references/api-reference.md8.1 KB
  • sub-skills/agent-workflows/references/planning-and-memory.md5.6 KB
  • sub-skills/agent-workflows/references/troubleshooting.md6.8 KB
  • sub-skills/agent-workflows/references/workflows.md5.9 KB
  • sub-skills/agent-workflows/scripts/inspect_agent_run.py5.5 KB
  • sub-skills/cli-and-ui/SKILL.md3.4 KB
  • sub-skills/cli-and-ui/references/cli-reference.md4.6 KB
  • sub-skills/cli-and-ui/references/troubleshooting.md4.1 KB
  • sub-skills/cli-and-ui/references/ui-workflows.md4.2 KB
  • sub-skills/cli-and-ui/scripts/print_cli_help.py1.8 KB
  • sub-skills/execution-and-safety/SKILL.md5.3 KB
  • sub-skills/execution-and-safety/references/executor-reference.md7.3 KB
  • sub-skills/execution-and-safety/references/security-workflows.md6 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.