serving-llms-vllm
Warn
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions for the agent to execute shell commands to install dependencies and manage inference services. Nested bullet points for evidence details: • Commands include
pip install vllm,vllm serve meta-llama/Llama-3-8B-Instruct, andpip install locustinSKILL.md. - [PRIVILEGE_ESCALATION]: The documentation advises the user or agent to use elevated privileges to perform network configuration changes. Nested bullet points for evidence details: • The skill suggests executing
sudo ufw allow 8000to open ports in the system firewall withinreferences/troubleshooting.md. - [DYNAMIC_EXECUTION]: The skill frequently encourages the use of a specific vLLM/Transformers flag that enables the loading and execution of arbitrary code from remote sources. Nested bullet points for evidence details: • Instructions in
SKILL.mdandreferences/troubleshooting.mdrecommend using the--trust-remote-codeflag for custom models, which permits the execution of Python code bundled with model weights. - [REMOTE_CODE_EXECUTION]: By recommending the
--trust-remote-codeflag, the skill facilitates a path for remote code execution if the model repository is untrusted or compromised. Nested bullet points for evidence details: • The--trust-remote-codeflag triggers the execution of remote scripts from model hubs like Hugging Face. - [INDIRECT_PROMPT_INJECTION]: The skill defines a batch inference workflow where data from a local file is processed by the agent's LLM tools without established safety boundaries. Nested bullet points for evidence details: • Ingestion points: The skill reads input strings from
prompts.txtinSKILL.md(Workflow 2, Step 1). • Boundary markers: No delimiters or 'ignore' instructions are provided for the processed file content. • Capability inventory: The skill usesvllm serveand file writing operations (results.jsonl). • Sanitization: There is no logic provided to sanitize or filter the content ofprompts.txtbefore it is passed to the generation engine.
Audit Metadata