hf-cloud-sagemaker-production-defaults
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
invoke_endpoint.pyandteardown.pyscripts utilizesubprocess.runto invoke the AWS CLI for managing SageMaker resources. The implementation correctly passes arguments as a list and avoids usingshell=True, which is a secure method for executing external commands and prevents shell injection vulnerabilities. - [REMOTE_CODE_EXECUTION]: The documentation includes instructions for setting the
SM_VLLM_TRUST_REMOTE_CODEenvironment variable for SageMaker containers. This is a standard configuration for vLLM models to load specific model logic from Hugging Face Hub and is intended for legitimate deployment purposes. - [SAFE]: The skill implements infrastructure-as-code best practices by providing idempotent teardown scripts and utilizing consistent tagging conventions. It also addresses potential platform-specific issues, such as the UTF-8 Byte Order Mark (BOM) in Windows, to ensure reliable request handling.
Audit Metadata