sglang
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (e.g., articles, user queries) by interpolating them into prompts for structured extraction.\n
- Ingestion points: Functions such as
extract_person,structured_extraction, andagent_workflowinSKILL.mdaccept strings from external sources.\n - Boundary markers: The skill leverages SGLang's constrained decoding capabilities (
json_schema,regex, andgrammarinsgl.gen()) which enforce strict output formatting, acting as a boundary to prevent the model from following embedded malicious instructions.\n - Capability inventory: Analysis of the skill's scripts (
SKILL.md) shows the tool is used for API-based inference; no patterns for arbitrary file system access or system command execution using this data were found.\n - Sanitization: The skill does not perform explicit sanitization or escaping of the input variables before prompt interpolation.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
sglangframework and hardware-optimized dependencies from public registries.\n - Evidence:
SKILL.mdincludes commands forpip install "sglang[all]"andgit clone https://github.com/sgl-project/sglang.git. It also points to the official FlashInfer wheel index athttps://flashinfer.ai/whl/cu121/torch2.4/.\n- [COMMAND_EXECUTION]: The documentation provides shell commands to launch and manage inference servers and deployment infrastructure.\n - Evidence:
SKILL.mdandreferences/deployment.mdcontain commands forpython -m sglang.launch_server,docker run, and Kubernetes manifest examples.
Audit Metadata