litellm-setup
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an installation script for the 'uv' package manager from 'https://astral.sh/uv/install.sh'. This is a well-known service for Python tooling.
- [REMOTE_CODE_EXECUTION]: A quickstart shell script is downloaded from the vendor's official GitHub repository at 'https://raw.githubusercontent.com/BerriAI/litellm/main/scripts/quickstart.sh' and executed to initialize the environment.
- [REMOTE_CODE_EXECUTION]: The skill fetches a JSON configuration file from 'https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json' and pipes it directly into a Python command to process model metadata. Since this originates from the official vendor repository, it is considered standard functionality for the skill's purpose.
- [COMMAND_EXECUTION]: The skill performs various system-level operations including Docker container management, file permission changes (chmod 600), and process management (nohup/kill). These are necessary for self-hosting an LLM gateway.
- [SAFE]: The skill demonstrates high awareness of secret management by instructing the agent to never print provider keys or master keys, using 'grep -c' to verify variable existence, and ensuring sensitive data resides only in '.env' files which are added to '.gitignore'.
Audit Metadata