flash
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to package and execute local Python code on remote Runpod workers using decorators like
@Endpoint. This involves shipping function bodies via cloudpickle and installing remote dependencies liketorchorpandas. - [COMMAND_EXECUTION]: The instructions guide the agent to perform local shell operations, including starting background processes (
flash dev), monitoring logs withgrep, and testing endpoints viacurl. These are standard development tasks for the provided CLI tool. - [REMOTE_CODE_EXECUTION]: The skill requires installing the
runpod-flashtool viauvorpipand managing environment-specific dependencies. All installation targets and resource URLs (PyPI, HuggingFace, Runpod) are trusted or well-known services. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests user code and processes data for remote execution, it possesses an attack surface for indirect injection. However, this is inherent to its primary purpose as a developer tool and is documented within standard operating patterns.
Audit Metadata