lambda-labs-gpu-cloud
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a shell script directly from Lambda Labs' official domain (
lambdalabs.com) to install or update the system stack. - [COMMAND_EXECUTION]: Includes various administrative and system-level commands, such as
sudo reboot,sudo apt install, and Docker operations, which are intended for managing the environment of the launched GPU instances. - [EXTERNAL_DOWNLOADS]: The documentation and scripts reference several external resources, including Python packages from PyPI, machine learning models from Hugging Face, and setup scripts from vendor-owned domains.
- [INDIRECT_PROMPT_INJECTION]: The skill includes automation scripts for executing commands on remote instances and streaming back logs (e.g., via
paramiko). This ingestion of external data constitutes a potential attack surface, although it is within the intended scope of managing remote infrastructure. - Ingestion points: Remote command output and log files streamed via SSH using the
paramikolibrary inreferences/advanced-usage.md. - Boundary markers: None explicitly implemented in the provided Python automation scripts.
- Capability inventory: Includes remote shell execution (
client.exec_command), file system writes, and package installations (pip install). - Sanitization: The scripts do not include specific sanitization for the content returned from remote logs or command outputs before they are printed to the console.
Audit Metadata