modal-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation and README suggest installation methods that involve piping remote scripts directly to a shell.
- Evidence:
curl -fsSL https://raw.githubusercontent.com/rajivmehtaflex/modal-deploy/main/install.sh | bashin README.md targets the author's own repository. - Evidence:
curl -LsSf https://astral.sh/uv/install.sh | shin SKILL.md is used to install the well-knownuvpackage manager from a recognized developer (Astral). - [COMMAND_EXECUTION]: The skill contains deployment templates and scripts that execute system commands and facilitate remote shell access.
- Evidence:
templates/main.pyimplements a PTY-WebSocket bridge usingpty.fork()andos.execvpe("/bin/bash", ...)to provide a browser-based terminal. - Evidence:
templates/check_gpu.pyusessubprocess.runto call themodalCLI for resource allocation testing. - Documentation in SKILL.md explicitly warns users that the terminal template has no authentication and advises against storing secrets in the container.
- [EXTERNAL_DOWNLOADS]: The installation script fetches the full skill source code from a remote repository.
- Evidence:
install.shusescurlorgh repo cloneto download the source archive fromgithub.com/rajivmehtaflex/modal-deploy.
Audit Metadata