roofline-runtime
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill follows standard operational security and infrastructure management best practices. It incorporates settings for air-gapped environments, such as disabling external telemetry (VLLM_NO_USAGE_STATS, DO_NOT_TRACK) and pinning engine versions by docker digest. All documentation links refer to trusted official project sites or reputable engineering guides.
- [COMMAND_EXECUTION]: The skill utilizes a task runner to execute shell-based commands for managing the lifecycle of inference processes (e.g.,
task serve,task stop). These operations are necessary for the skill's primary function of infrastructure automation and are limited to local process management. - [INDIRECT_PROMPT_INJECTION]: The skill describes processes where the agent reviews server logs and smoke-test outputs to verify runtime health.
- Ingestion points: Retrieval of inference logs via
task logsand validation of tool-calling outputs viatask smoke-toolcall. - Boundary markers: None explicitly defined in the instructions for log analysis.
- Capability inventory: The agent can manage local inference services using the
taskCLI. - Sanitization: No specific content filtering is applied to the logs before agent inspection. These monitoring activities are standard for infrastructure maintenance and pose minimal risk in this implementation context.
Audit Metadata