sglang
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or security vulnerabilities were identified. The skill consists of legitimate technical documentation, technical deep dives, and deployment templates for a well-known open-source serving framework.
- [EXTERNAL_DOWNLOADS]: Installation instructions reference standard package registries and well-known services (such as flashinfer.ai) for specialized GPU kernels. These are documented neutrally as required for the framework's high-performance capabilities.
- [COMMAND_EXECUTION]: The deployment guides (Docker, Kubernetes, Ray) include standard administrative commands for launching servers and managing infrastructure. These are informational examples intended for manual execution by developers or system administrators.
- [INDIRECT_PROMPT_INJECTION]: The skill provides numerous examples of prompt construction and agentic workflows. While these patterns naturally involve interpolating user data into prompts—creating a standard indirect prompt injection surface—the examples are educational and do not include malicious payloads. The documentation also includes a security section recommending API key authentication and network policies to mitigate risks.
Audit Metadata