vllm
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a diagnostic script
scripts/vllm-healthand associated teststests/test_vllm_health.py. Thetest_vllm_health.pyfile usessubprocess.runto execute the local health script as part of its deterministic testing suite. This is a standard practice for verifying CLI behavior and is contained within the test environment. - [EXTERNAL_DOWNLOADS]: The documentation and templates provide
docker runandpip installcommands for vLLM. These reference official sources, including thevllm/vllm-openaiDocker image andvllmpackage on PyPI. Thevllm-healthscript performs HTTP GET requests to the user-supplied server URL to collect status metrics, which is consistent with its primary purpose as a health probe. - [DATA_EXFILTRATION]: The
vllm-healthscript is verified to be read-only, usingmethod="GET"for all network requests. It does not write files or transmit collected metrics to any external or third-party domains. The skill explicitly instructs agents not to print or commit sensitive environment variables or Hugging Face tokens to logs or chat sessions. - [CREDENTIALS_UNSAFE]: The skill correctly follows security best practices by recommending the use of environment variables (
HF_TOKEN) and Kubernetes secrets for authentication tokens, rather than hardcoding them in scripts or configuration files.
Audit Metadata