Skills
skills/bbuf/sglang-auto-driven-skills/model-architecture-diagram/Gen Agent Trust Hub

model-architecture-diagram

Warn

Audited by Gen Agent Trust Hub on May 3, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill's workflow in SKILL.md instructs the agent to run the shell command python3 skills/model-architecture-diagram/scripts/model_architecture_diagram.py "<model name>". Because the <model name> placeholder is substituted with user input and enclosed in double quotes, it is vulnerable to command injection through shell metacharacters such as $() or backticks, allowing potential execution of arbitrary code.
  • [EXTERNAL_DOWNLOADS]: The SKILL.md documentation describes a procedure to download a ZIP archive from a remote GitHub release (https://github.com/BBuf/AI-Infra-Auto-Driven-SKILLS/releases/download/sgl-cookbook-architecture-images-2026-05-02/sgl-cookbook-model-architecture-images-2026-05-02.zip) and unzip it to the /tmp directory. Although the download is from the skill author's repository and provided with a SHA256 checksum for verification, it involves the retrieval and processing of remote content.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 3, 2026, 03:23 AM