vllm-deploy-k8s

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to ask the user for their Hugging Face token and then embed that token verbatim into a kubectl create secret --from-literal=HF_TOKEN="... " command, which requires the LLM to handle and output the secret directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Deployment pulls and runs the external container image vllm/vllm-openai:latest (pulled from Docker Hub, e.g. https://hub.docker.com/r/vllm/vllm-openai), which is fetched at runtime, is a required dependency, and executes remote code inside the cluster.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill explicitly instructs the agent to create Kubernetes secrets, apply and delete Deployments/Services, and run kubectl commands (including port-forwarding), which modify cluster/host state and could compromise the machine or cluster if misused.