install-stack-flagos

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes docker exec and Python's subprocess module to perform environment discovery and software installation. Commands like ldd, nvidia-smi, and curl are used to probe the container's capabilities and network status. Software installation is performed using pip and make within the container environment.
  • [EXTERNAL_DOWNLOADS]: The skill fetches code and packages from several external sources including official GitHub repositories for FlagOpen and flagos-ai (the skill vendor), well-known academic mirrors for PyPI, and vendor-specific repositories for pre-compiled wheels. These sources are consistent with the skill's purpose and include fallback mechanisms for reliability.
  • [DYNAMIC_EXECUTION]: The validation script uses importlib.import_module to confirm successful installation of the stack components. This dynamic loading is restricted to a hardcoded list of the specific packages the skill installs (e.g., vllm, flag_gems, flagcx).
  • [PERSISTENCE]: The skill configures the container environment by appending export commands to ~/.bashrc. Specifically, it sets the FLAGCX_PATH variable, which is a standard configuration step for the FlagCX library to function correctly in future sessions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 08:43 AM
Security Audit — agent-trust-hub — install-stack-flagos