roboflow-inference

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the uv package manager installation script from astral.sh, a well-known service in the Python ecosystem.
  • [CREDENTIALS_UNSAFE]: Adheres to security best practices by instructing the agent to use environment variables (ROBOFLOW_API_KEY) for authentication and explicitly warning against hardcoding API keys in scripts.
  • [COMMAND_EXECUTION]: Utilizes standard CLI tools (inference-cli) for managing batches, submitting jobs, and controlling local inference servers. It also correctly advises requesting user permission before running system-level commands like starting the Docker daemon.
  • [REMOTE_CODE_EXECUTION]: Provides legitimate Python integration examples and utility scripts using official vendor SDKs (inference-sdk, inference) and handles package installations from standard registries.
  • [SAFE]: Processes external image and video data. 1. Ingestion points: Input images, videos, and signed URLs in SKILL.md and batch-staging.md. 2. Boundary markers: Not explicitly defined in instructions. 3. Capability inventory: CLI processing and SDK-based inference calls across multiple documentation files. 4. Sanitization: Handled by the Roboflow API and processing backend.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 11:10 PM
Security Audit — agent-trust-hub — roboflow-inference