lambda-labs-gpu-cloud

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a shell script directly from Lambda Labs' official domain (lambdalabs.com) to install or update the system stack.
  • [COMMAND_EXECUTION]: Includes various administrative and system-level commands, such as sudo reboot, sudo apt install, and Docker operations, which are intended for managing the environment of the launched GPU instances.
  • [EXTERNAL_DOWNLOADS]: The documentation and scripts reference several external resources, including Python packages from PyPI, machine learning models from Hugging Face, and setup scripts from vendor-owned domains.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes automation scripts for executing commands on remote instances and streaming back logs (e.g., via paramiko). This ingestion of external data constitutes a potential attack surface, although it is within the intended scope of managing remote infrastructure.
  • Ingestion points: Remote command output and log files streamed via SSH using the paramiko library in references/advanced-usage.md.
  • Boundary markers: None explicitly implemented in the provided Python automation scripts.
  • Capability inventory: Includes remote shell execution (client.exec_command), file system writes, and package installations (pip install).
  • Sanitization: The scripts do not include specific sanitization for the content returned from remote logs or command outputs before they are printed to the console.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 05:50 AM