serving-llms-vllm

Warn

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill contains instructions for the agent to execute shell commands to install dependencies and manage inference services. Nested bullet points for evidence details: • Commands include pip install vllm, vllm serve meta-llama/Llama-3-8B-Instruct, and pip install locust in SKILL.md.
  • [PRIVILEGE_ESCALATION]: The documentation advises the user or agent to use elevated privileges to perform network configuration changes. Nested bullet points for evidence details: • The skill suggests executing sudo ufw allow 8000 to open ports in the system firewall within references/troubleshooting.md.
  • [DYNAMIC_EXECUTION]: The skill frequently encourages the use of a specific vLLM/Transformers flag that enables the loading and execution of arbitrary code from remote sources. Nested bullet points for evidence details: • Instructions in SKILL.md and references/troubleshooting.md recommend using the --trust-remote-code flag for custom models, which permits the execution of Python code bundled with model weights.
  • [REMOTE_CODE_EXECUTION]: By recommending the --trust-remote-code flag, the skill facilitates a path for remote code execution if the model repository is untrusted or compromised. Nested bullet points for evidence details: • The --trust-remote-code flag triggers the execution of remote scripts from model hubs like Hugging Face.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a batch inference workflow where data from a local file is processed by the agent's LLM tools without established safety boundaries. Nested bullet points for evidence details: • Ingestion points: The skill reads input strings from prompts.txt in SKILL.md (Workflow 2, Step 1). • Boundary markers: No delimiters or 'ignore' instructions are provided for the processed file content. • Capability inventory: The skill uses vllm serve and file writing operations (results.jsonl). • Sanitization: There is no logic provided to sanitize or filter the content of prompts.txt before it is passed to the generation engine.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 1, 2026, 05:59 AM