vllm-deploy-k8s

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses kubectl to interact with a Kubernetes cluster. It performs standard operations including creating, checking, and deleting Deployments, Services, and Secrets. These operations are within the stated scope of managing a vLLM deployment.
  • [EXTERNAL_DOWNLOADS]: The deployment template references the vllm/vllm-openai:latest container image. This is the official image provided by the vLLM project and is considered a well-known and trusted source for this application.
  • [CREDENTIALS_UNSAFE]: The skill provides instructions for the agent to securely handle a Hugging Face API token. It asks the user for the token at runtime and uses kubectl create secret to store it within the cluster. This is an appropriate method for secret management and avoids exposing credentials in plain text or history files.
  • [DATA_EXFILTRATION]: No unauthorized data access or external transmission patterns were detected. Network operations are limited to the Kubernetes API via kubectl and a local connectivity test via curl to localhost.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 10:29 AM