skills/uxfion/skills/vllm-serve/Gen Agent Trust Hub

vllm-serve

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/serve.py script extensively uses subprocess.Popen and subprocess.run to manage the vLLM server processes, Hugging Face download tools, and environment discovery.
  • Evidence: The supervisor logic in scripts/serve.py spawns vllm serve and hf download processes.
  • Evidence: tests/conventions_fixture.py and tests/test_serve.py execute the skill's main script via subprocess for validation.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions and automation for installing vLLM and its dependencies from official sources.
  • Evidence: references/install.md directs the user to install vLLM via uv tool install and references an official binary wheel from github.com/vllm-project.
  • Evidence: references/shared-machines.md contains a command to install the uv tool via curl from astral.sh.
  • [DYNAMIC_EXECUTION]: The skill uses Python's ctypes library to interact with system-level process management features on Linux.
  • Evidence: scripts/serve.py calls ctypes.CDLL(None).prctl(1, signal.SIGTERM) to ensure child processes (the model servers) are terminated if the supervisor process exits, preventing orphan GPU processes.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for processing external data by providing a template for analyzing server logs.
  • Ingestion points: The skill instructs the agent to read vLLM server logs for troubleshooting (SKILL.md).
  • Boundary markers: While explicit delimiters for log content are not provided in the template, the prompt includes strong negative constraints to limit the analyzer's actions.
  • Capability inventory: The skill has file read/write, network access to local services, and process management capabilities.
  • Sanitization: The troubleshooting prompt specifically commands the agent: "Write no files, send no subagents, no git," mitigating the risk of log-embedded instructions triggering unintended actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 03:20 AM