llm-serving-auto-benchmark

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly pulls models and datasets from public sources (e.g., model_path entries and HF_TOKEN usage in references/container-runbook.md and many cookbook configs), sets trust_remote_code in multiple configs (allowing remote repo code execution), and the SKILL.md / Known Gotchas note that trtllm's benchmark with --dataset-name random can silently fall back to ShareGPT (user-generated content)—all of which show the agent will ingest untrusted, user-provided third-party content that can change runtime behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The runbook explicitly pulls and runs remote container images during runtime (e.g., docker pull lmsysorg/sglang:dev and nvcr.io/nvidia/tensorrt-llm/release:latest), which fetches and executes remote code and are required dependencies for the skill, so they constitute runtime external code-execution risks.