vllm-bench-serve

This script automates vLLM benchmarking and saves results and an optimization report. Its main security issue is shell injection: user-controlled command-line strings are interpolated into a command executed with shell=True, potentially allowing arbitrary command execution if an attacker can control those arguments. Benchmark traffic goes to the user-configured --base-url, and files are written under --result-dir; no fixed suspicious domain, credential target, or malicious payload is present. Severity is high when arguments are attacker-controlled, but otherwise this is a command-construction vulnerability rather than evidence of intentional malware.

This is a service-probing utility with expected HTTP health, model, and endpoint checks. The main security issue is Python code injection through the unescaped --base-url interpolation in the final python3 -c command; crafted input can execute code with the script's privileges, so do not pass an untrusted base URL. The POST probes can also induce small requests on the configured service, and model roots may expose server-side paths. No malicious domain, credential harvesting, or other malware behavior is evident.

This batch runner executes benchmark commands assembled from command-line inputs and JSONL configuration. Untrusted values can reach bash -c without shell-safe escaping, creating a command-injection risk; case names and result paths can also influence output locations. No explicit credential theft, exfiltration, or other malware behavior is evident. Severity is a security warning, with risk dependent on whether inputs are trusted.

This is a benchmark wrapper that deliberately executes a caller-supplied shell command using bash -c and writes its output to a log. The main security concern is arbitrary command execution if an untrusted party can control the command argument, plus caller-controlled result-directory creation. No independent malware behavior or network destination is evident in the code; severity depends on who can supply the arguments.