trtllm-flashinfer-upgrade
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches release tags and package metadata from the official GitHub API (
api.github.com) and PyPI (pypi.org). These are well-known, trusted services used here to identify available versions and verify file hashes. - [COMMAND_EXECUTION]: The skill uses shell commands to interact with the repository (
git), manage authentication and PRs (gh), and download data (curl). These are standard operations for a developer-oriented skill and are used as intended for repository maintenance. - [REMOTE_CODE_EXECUTION]: The skill processes JSON data by piping
curloutput topython3 -c. While automated scanners may flag this pattern, the Python logic is hardcoded within the skill itself to perform specific parsing tasks (extracting tags and hashes), rather than executing arbitrary code downloaded from the internet. - [SAFE]: The skill follows security best practices by implementing "human-in-the-loop" checkpoints. It uses
AskUserQuestionto ensure the user confirms the desired version and decides whether to update the lockfile before any destructive actions or commits occur.
Audit Metadata