skills/magnus919/agent-skills/vllm/Gen Agent Trust Hub

vllm

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a diagnostic script scripts/vllm-health and associated tests tests/test_vllm_health.py. The test_vllm_health.py file uses subprocess.run to execute the local health script as part of its deterministic testing suite. This is a standard practice for verifying CLI behavior and is contained within the test environment.
  • [EXTERNAL_DOWNLOADS]: The documentation and templates provide docker run and pip install commands for vLLM. These reference official sources, including the vllm/vllm-openai Docker image and vllm package on PyPI. The vllm-health script performs HTTP GET requests to the user-supplied server URL to collect status metrics, which is consistent with its primary purpose as a health probe.
  • [DATA_EXFILTRATION]: The vllm-health script is verified to be read-only, using method="GET" for all network requests. It does not write files or transmit collected metrics to any external or third-party domains. The skill explicitly instructs agents not to print or commit sensitive environment variables or Hugging Face tokens to logs or chat sessions.
  • [CREDENTIALS_UNSAFE]: The skill correctly follows security best practices by recommending the use of environment variables (HF_TOKEN) and Kubernetes secrets for authentication tokens, rather than hardcoding them in scripts or configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 09:20 PM
Security Audit — agent-trust-hub — vllm