infrastructure-modal
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes code examples that utilize
subprocess.runto execute system utilities such asnvidia-smiandpip list. These are intended for environment verification and debugging in a GPU computing context. - [INDIRECT_PROMPT_INJECTION]: Several examples, such as the text generation endpoint in
SKILL.md, ingest user-supplied strings as prompts for machine learning models. This creates a surface for indirect prompt injection which is typical for model serving applications. - Ingestion points: The
promptparameter in theTextGenerator.generatemethod located inSKILL.md. - Boundary markers: No specific delimiters or safety instructions for input handling are included in the basic examples.
- Capability inventory: The skill demonstrates the ability to execute system commands via
subprocess.run(SKILL.md) and documents the platform's ability to run code in sandboxed environments viamodal.Sandbox.exec(advanced-usage.md). - Sanitization: The provided examples do not demonstrate explicit input sanitization or filtering.
- [EXTERNAL_DOWNLOADS]: The documentation includes examples of installing dependencies directly from Hugging Face's official GitHub repository using pip.
Audit Metadata