deployment
Fail
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instruction file 'references/unsupported-models.md' guides the agent to perform live-patching of framework source code using 'sed -i' on installed library files (e.g., in '/usr/local/lib'). This dynamic modification of system-wide packages is a dangerous capability that can lead to the introduction of persistent malicious code or system instability if the patch logic is influenced by untrusted data.- [REMOTE_CODE_EXECUTION]: Automated scans detected patterns where data fetched via network operations is piped directly into a Python interpreter (e.g., 'curl ... | python3' in 'scripts/deploy.sh'). Although currently used for JSON parsing with '-m json.tool' or fixed script strings, this pattern represents a significant risk surface if the local server output can be manipulated via indirect prompt injection or other means.- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8) by ingesting model configuration files ('hf_quant_config.json', 'config.json') to drive deployment logic. The extracted data is used to construct shell commands without strict sanitization or explicit boundary markers, potentially allowing a malicious model checkpoint to influence agent behavior.- [SAFE]: The skill utilizes well-known, industry-standard packages and official vendor resources from NVIDIA (vLLM, SGLang, TensorRT-LLM) for its primary functionality, which is appropriate for its stated purpose.
Recommendations
- HIGH: Downloads and executes remote code from: http://localhost:$PORT/v1/models, http://localhost:8000/v1/models - DO NOT USE without thorough review
Audit Metadata