runpod
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
curlandsshfor orchestrating cloud resources. Analysis confirms these commands are used for legitimate interactions with the official RunPod API and the user's provisioned pods for syncing project code and managing pod lifecycles. - [REMOTE_CODE_EXECUTION]: Automated scanners flagged instances where API responses are piped to Python. Manual review confirms these are safe data-parsing patterns (e.g.,
curl ... | python3 -c '...') where a local Python one-liner is used to extract information from JSON responses returned by the official RunPod API. No execution of remote or untrusted code was detected. - [EXTERNAL_DOWNLOADS]: The skill downloads dependencies and container images from well-known and trusted services, including the RunPod API, GitHub Container Registry (
ghcr.io), and Ubuntu repositories. These downloads are part of the standard setup process for the intended GPU training environment. - [CREDENTIALS_SAFE]: The skill manages authentication tokens for the RunPod API via environment variables and includes best-practice advice for secure storage using the system keychain, avoiding the use of hardcoded secrets or unsafe storage methods.
Audit Metadata