modal-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documentation and README suggest installation methods that involve piping remote scripts directly to a shell.
  • Evidence: curl -fsSL https://raw.githubusercontent.com/rajivmehtaflex/modal-deploy/main/install.sh | bash in README.md targets the author's own repository.
  • Evidence: curl -LsSf https://astral.sh/uv/install.sh | sh in SKILL.md is used to install the well-known uv package manager from a recognized developer (Astral).
  • [COMMAND_EXECUTION]: The skill contains deployment templates and scripts that execute system commands and facilitate remote shell access.
  • Evidence: templates/main.py implements a PTY-WebSocket bridge using pty.fork() and os.execvpe("/bin/bash", ...) to provide a browser-based terminal.
  • Evidence: templates/check_gpu.py uses subprocess.run to call the modal CLI for resource allocation testing.
  • Documentation in SKILL.md explicitly warns users that the terminal template has no authentication and advises against storing secrets in the container.
  • [EXTERNAL_DOWNLOADS]: The installation script fetches the full skill source code from a remote repository.
  • Evidence: install.sh uses curl or gh repo clone to download the source archive from github.com/rajivmehtaflex/modal-deploy.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 12:43 PM
Security Audit — agent-trust-hub — modal-deploy