generate-profile
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the server lifecycle and run profiling tools.
- Evidence:
sglang serve,python3 -m sglang.test.run_eval, andpython3 -m sglang.test.send_oneinSKILL.md. - [COMMAND_EXECUTION]: Employs the
pkillcommand to terminate background server processes. - Evidence:
pkill -9 -f "sglang.launch_server\|sglang serve\|sglang.srt"inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface where untrusted user input could influence shell command execution.
- Ingestion points: User-supplied values for
<gpu_id>,<model>, and<port>inSKILL.md. - Boundary markers: Absent; placeholders are directly interpolated into shell commands without delimiters.
- Capability inventory: Execution of shell commands and process management via
sglangCLI and Python modules. - Sanitization: None; the instructions do not specify validation or escaping for the user-provided strings.
Audit Metadata