The Agent Skills Directory

[SAFE]: No security issues were identified during the analysis of the skill body or metadata.\n- [EXTERNAL_DOWNLOADS]: The skill references downloads for the vllm package from PyPI and documentation from docs.vllm.ai and github.com/vllm-project/vllm. These are well-known, official sources for the software and are categorized as safe.\n- [COMMAND_EXECUTION]: The documentation includes common CLI examples such as pip install vllm, vllm serve, and curl commands for API interaction. These are standard instructional content for setting up the inference engine and do not contain malicious payloads.\n- [REMOTE_CODE_EXECUTION]: The scripts/check-updates.py file is a utility for skill maintainers to check for package updates via the PyPI JSON API and verify local file integrity. The script performs standard network requests to a trusted registry (pypi.org) and local file system operations without any dynamic execution or dangerous sink usage.\n- [INDIRECT_PROMPT_INJECTION]: As a documentation skill, it possesses an ingestion surface (processing user queries about LLM serving) and provides instructions on how to configure the vLLM engine. It includes documentation on safety features like --allowed-media-domains to prevent SSRF and API key authentication to secure deployments. While it documents how to load model weights and adapters, it correctly identifies the risks associated with these actions (e.g., trust_remote_code and VLLM_ALLOW_RUNTIME_LORA_UPDATING).

vllm