Sglang Amd Bench

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:27 AM UTC
• Version: 0.1.0

Overview

This benchmarking skill is mostly coherent, but it can run model-supplied code and force-kill broad SGLang processes without enough scoping or warning.

Review this skill carefully before installing, especially on shared GPU hosts. Only use it with trusted model repositories or local model files, because it always enables model remote code execution. Avoid running the bundled stop.sh as-is where unrelated SGLang jobs may exist; require PID-scoped cleanup or manual confirmation before killing processes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/serve.sh:91

Finding

Unconditional Execution of Model-Supplied Remote Code

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/stop.sh:11

Finding

Overbroad Force-Termination of Unrelated SGLang Processes

Content

View full analysis

Remediation

View remediation

"$LOG_FILE" 2>&1 & SERVER_PID=$! printf '%s\n' "$SERVER_PID" >"$PID_FILE" ``` 2. Protect the PID file with restrictive permissions and place it in a directory controlled by the benchmark user. 3. Before signaling the process, verify: - The PID is numeric. - The process still exists. - The process is owned by the expected user. - Its command line or executable matches the expected server. - On Linux, its `/proc//stat` start time matches a value recorded at launch, preventing PID-reuse errors. 4. Attempt graceful shutdown first: ```bash kill -TERM "$SERVER_PID" ``` 5. Wait for a bounded interval and send `SIGKILL` only to the same verified PID if it fails to exit. 6. Prefer SGLang's supported shutdown endpoint or lifecycle API when available. 7. Do not use broad `ps | grep | xargs kill` pipelines for lifecycle management. 8. If process-group termination is required for child workers, create a dedicated process group at launch and terminate only that recorded group after validating its identity. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill instructs the agent to stop processes and verify GPU cleanup, including killing sglang instances and interacting across host/container boundaries, but that destructive operational behavior is not surfaced in the high-level description. Hidden or under-disclosed process-control behavior is dangerous because users may invoke a 'benchmark' skill without realizing it can terminate active workloads or disrupt shared systems.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill instructs the agent to stop processes and verify GPU cleanup, including killing sglang instances and interacting across host/container boundaries, but that destructive operational behavior is not surfaced in the high-level description. Hidden or under-disclosed process-control behavior is dangerous because users may invoke a 'benchmark' skill without realizing it can terminate active workloads or disrupt shared systems.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill instructs the agent to stop processes and verify GPU cleanup, including killing sglang instances and interacting across host/container boundaries, but that destructive operational behavior is not surfaced in the high-level description. Hidden or under-disclosed process-control behavior is dangerous because users may invoke a 'benchmark' skill without realizing it can terminate active workloads or disrupt shared systems.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill instructs the agent to stop processes and verify GPU cleanup, including killing sglang instances and interacting across host/container boundaries, but that destructive operational behavior is not surfaced in the high-level description. Hidden or under-disclosed process-control behavior is dangerous because users may invoke a 'benchmark' skill without realizing it can terminate active workloads or disrupt shared systems.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill instructs the agent to stop processes and verify GPU cleanup, including killing sglang instances and interacting across host/container boundaries, but that destructive operational behavior is not surfaced in the high-level description. Hidden or under-disclosed process-control behavior is dangerous because users may invoke a 'benchmark' skill without realizing it can terminate active workloads or disrupt shared systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes reading and writing files, copying scripts, generating reports, and manipulating workspace artifacts, but it declares no explicit tool scope or permissions boundary. That creates unnecessary capability ambiguity and increases the chance an agent may perform filesystem actions broader than the user expects, especially in a remote/containerized environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

If the environment looks broken (missing module, version mismatch, ABI error, import crash), **STOP** and report the symptom to the user. Let the user decide whether to reinstall.

What you CAN do without asking:
- Inspect versions: `pip show sglang`, `python -c "import sglang; print(sglang.__file__)"`
- Read source files in the editable install
- Set environment variables for the run

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The instruction to probe for an existing server without asking the user authorizes autonomous interaction with local services and process discovery. In shared or sensitive environments, even seemingly harmless health checks and process enumeration can reveal service presence, operational state, ports, and process details that the user did not explicitly approve disclosing or touching.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

1b. Server setup

Check if a sglang server is already running — don't ask the user, just probe:

bash

curl -s http://localhost:30000/health && echo "Server is running" || echo "No server running"

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/server_config.md (reported line 63)May include surrounding context.

md

`--tp-size` in sglang is the **world size** (total GPUs), NOT tensor parallelism degree. The script derives it from the first number in CONFIG (e.g., `DP4EP4` → `--tp-size 4`).


| CONFIG       | sglang flags generated                                                                                 | Why                                                                          |
| ------------ | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
| `TP8`        | `--tp-size 8`                                                                                          | Pure TP, 8 GPUs                                                              |
| `DP4EP4`     | `--tp-size 4 --dp-size 4 --enable-dp-attention --enable-dp-lm-head --ep-size 4`                        | DP-attention requires both `--enable-dp-attention` AND `--enable-dp-lm-head` |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/server_config.md (reported line 65)May include surrounding context.

md

| CONFIG       | sglang flags generated                                                                                 | Why                                                                          |
| ------------ | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
| `TP8`        | `--tp-size 8`                                                                                          | Pure TP, 8 GPUs                                                              |
| `DP4EP4`     | `--tp-size 4 --dp-size 4 --enable-dp-attention --enable-dp-lm-head --ep-size 4`                        | DP-attention requires both `--enable-dp-attention` AND `--enable-dp-lm-head` |
| `DP8EP8_A2A` | `--tp-size 8 --dp-size 8 --enable-dp-attention --enable-dp-lm-head --ep-size 8 --moe-a2a-backend mori` | All-to-all EP uses mori backend                                              |
| `TP4EP4`     | `--tp-size 4 --ep-size 4`                                                                              | TP for attention + EP for MoE, no DP flags                                   |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that the launch path always adds --trust-remote-code, which permits execution of model-provided custom code from Hugging Face or local model repositories. In a benchmarking skill that accepts MODEL_PATH as a model ID or path, this materially increases the risk of arbitrary code execution if an untrusted or compromised model artifact is used, especially because the docs present it as unconditional behavior without a warning or safer alternative.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script unconditionally appends --trust-remote-code when launching the model server, which permits execution of model-supplied Python code during model loading. In a benchmarking skill, this is broader than necessary and turns use of any untrusted or compromised model repository into code execution on the host/container, especially risky on shared GPU benchmarking systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Because the launcher silently enables --trust-remote-code, users may run the benchmark without realizing that model-provided code can execute. The absence of an explicit warning increases the chance of accidental execution of malicious model code and weakens informed consent for a dangerous operation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/serve.sh (reported line 155)May include surrounding context.

sh

mkdir -p "$LOG_DIR"

if [[ "${BACKGROUND:-0}" == "1" ]]; then
  nohup $CMD > "$LOG_FILE" 2>&1 &
  echo "Server launched in background (PID: $!). Log: ${LOG_FILE}"
else
  exec $CMD 2>&1 | tee "$LOG_FILE"

Static analysis

No suspicious patterns detected.