hf-cloud-sagemaker-production-defaults

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The invoke_endpoint.py and teardown.py scripts utilize subprocess.run to invoke the AWS CLI for managing SageMaker resources. The implementation correctly passes arguments as a list and avoids using shell=True, which is a secure method for executing external commands and prevents shell injection vulnerabilities.
  • [REMOTE_CODE_EXECUTION]: The documentation includes instructions for setting the SM_VLLM_TRUST_REMOTE_CODE environment variable for SageMaker containers. This is a standard configuration for vLLM models to load specific model logic from Hugging Face Hub and is intended for legitimate deployment purposes.
  • [SAFE]: The skill implements infrastructure-as-code best practices by providing idempotent teardown scripts and utilizing consistent tagging conventions. It also addresses potential platform-specific issues, such as the UTF-8 Byte Order Mark (BOM) in Windows, to ensure reliable request handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 03:43 AM
Security Audit — agent-trust-hub — hf-cloud-sagemaker-production-defaults