serving-llms-vllm
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The troubleshooting guide suggests using
sudoto modify system firewall rules (sudo ufw allow 8000) to permit network traffic to the inference server. - [REMOTE_CODE_EXECUTION]: The skill documents the use of the
--trust-remote-codeflag, which allows the serving engine to download and execute arbitrary Python code contained within model repositories (such as those on Hugging Face). This is a standard requirement for models with custom architectures but relies on the integrity of the model source. - [INDIRECT_PROMPT_INJECTION]: The skill configures an LLM inference server that processes untrusted data via API endpoints.
- Ingestion points: The OpenAI-compatible API endpoint (
http://localhost:8000/v1) processes user-supplied prompts. - Boundary markers: The server uses structured messaging formats which provide clear delimiters between user, system, and assistant roles.
- Capability inventory: The primary capability is text generation; additional capabilities depend on the specific model's support for tool calling or code execution.
- Sanitization: Input validation and content filtering are expected to be implemented at the application or model level.
Audit Metadata