Dgx Spark Setup

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:39 AM UTC
• Version: 1.0.0

Overview

This is a coherent DGX setup guide, but it asks users to run unverified installers and expose a persistent inference service remotely without enough safety scoping.

Review and adapt the commands before installing. Prefer verified package-manager installs or pinned artifacts, pin Python dependency versions, verify any model code before using trusted-code loading, run services under least privilege, and restrict Tailscale/LiteLLM access to intended users and devices.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27
• Finding: Unverified Remote Installer Execution for uv and Tailscale## Vulnerability Details **File Location**: `SKILL.md:27`, `SKILL.md:152-154` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash - `uv` installed (`curl -LsSf https://astral.sh/uv/install.sh | sh`) ``` ```bash curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up ``` ### Technical Analysis The instructions pipe mutable HTTP responses directly into a shell. Although `astral.sh` and `tailscale.com` are consistent with the declared tools, the downloaded content is neither version-pinned nor verified using a checksum or cryptographic signature before execution. This construction combines retrieval and execution into one operation, preventing meaningful inspection of the effective payload. A compromise of an upstream installer, hosting account, CDN, DNS resolution path, or trusted certificate infrastructure could therefore result in arbitrary commands being executed under the invoking account. Installing uv and Tailscale is relevant to the Skill's stated purpose. However, executing mutable remote scripts without verification exceeds the minimum privilege and trust necessary to install these components safely. The subsequent `sudo tailscale up` command does not directly pipe remote content into a privileged shell, but it increases the sensitivity of the installation workflow because the newly installed software is subsequently used in a privileged networking operation. ### Attack Path 1. An attacker compromises an installer origin, deployment pipeline, CDN, or another trusted component in the delivery path. 2. The attacker modifies the response returned by `install.sh`. 3. A user follows the Skill instructions and executes the `curl | sh` command. 4. The hostile response is immediately interpreted by the local shell. 5. The payload gains the permissions of the invoking user and may modify user files, steal accessible credentials, ...[truncated 665 chars]
• Remediation: ## Remediation Suggestions 1. Do not pipe network responses directly into a shell. 2. Prefer signed operating-system packages or an official package repository with repository-signing verification. 3. If an installation script is unavoidable, download it to a non-executable temporary file first: ```bash curl --proto '=https' --tlsv1.2 -fLo install.sh https://example.invalid/versioned/install.sh ``` 4. Pin the installer or package to an explicit release version. 5. Verify a vendor-published cryptographic signature or checksum obtained through an independently authenticated channel. 6. Inspect the downloaded script before running it. 7. Execute the installer as an unprivileged account and grant narrowly scoped privileges only where required. 8. Separate installation from `sudo tailscale up`, and verify the installed binary's source, ownership, and integrity before invoking any privileged operation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55
• Finding: Unpinned Python and Build Dependencies Create Supply-Chain Exposure## Vulnerability Details **File Location**: `SKILL.md:55-66`, `SKILL.md:106` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install flashinfer-python pip install flashinfer # cubin package — must match flashinfer-python version ``` ```bash cd ~/vllm-install git clone https://github.com/vllm-project/vllm.git cd vllm git checkout 66a168a197ba214a5b70a74fa2e713c9eeb3251a pip install -e . --no-build-isolation ``` ```bash pip install litellm ``` ### Technical Analysis The installation commands do not pin `flashinfer-python`, `flashinfer`, or `litellm` to exact versions and do not verify package hashes. The document expressly states that the two FlashInfer package versions must match, but the commands permit the package resolver to select whatever releases are current when the instructions are executed. The vLLM repository itself is pinned to a commit, which reduces direct source mutability. Nevertheless, `pip install -e . --no-build-isolation` can still resolve and install mutable transitive dependencies unless those dependencies are constrained by a reviewed lockfile. Python packages may execute code during build, installation, import, or service startup. This creates both security and reliability risks. A compromised registry account, malicious release, altered transitive dependency, or incompatible package update can introduce executable code into the inference and authentication stack. ### Attack Path 1. An attacker compromises a package maintainer or registry account, or publishes a malicious dependency version that satisfies the unconstrained requirements. 2. A user follows the Skill and invokes the unpinned `pip install` command. 3. The resolver selects the attacker-controlled or compromised release. 4. Malicious code executes during package build or installation, or later when LiteLLM, FlashInfer, or vLLM imports the pa ...[truncated 670 chars]
• Remediation: ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version. 2. Use a generated lockfile that also constrains transitive dependencies. 3. Require package hashes, for example through a requirements file used with `--require-hashes`. 4. Explicitly configure trusted package indexes and disallow unintended fallback indexes. 5. Confirm and pin mutually compatible versions of `flashinfer` and `flashinfer-python`. 6. Build reviewed wheels in an isolated build environment and install those immutable artifacts on the DGX system. 7. Preserve the vLLM commit pin, but also lock and audit its build and runtime dependencies. 8. Run dependency vulnerability and provenance checks before deployment. 9. Execute vLLM and LiteLLM under dedicated, unprivileged accounts with access only to required model and configuration files.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:89
• Finding: Model-Supplied Python Code Is Trusted During vLLM Startup## Vulnerability Details **File Location**: `SKILL.md:89-96` **Vulnerability Type**: Unsafe execution of custom model code **Risk Level**: Medium ### Vulnerable Code ```bash TORCH_CUDA_ARCH_LIST=12.1a \ VLLM_USE_FLASHINFER_MXFP4_MOE=1 \ TRITON_PTXAS_PATH=/usr/local/cuda/bin/ptxas \ python -m vllm.entrypoints.openai.api_server \ --model /home/jhernandez/models/nemotron-super-120b-nvfp4 \ --trust-remote-code --max-model-len 8192 \ --gpu-memory-utilization 0.85 --port 8000 ``` ### Technical Analysis The `--trust-remote-code` option permits custom Python code supplied with the model to execute while the model is loaded. The configured model path is local, so the audited content does not prove that code is downloaded at runtime. However, the model directory is not pinned to a reviewed revision and no integrity verification procedure is documented. Consequently, anyone able to replace or modify relevant files in the local model directory can turn the next vLLM startup into a code-execution event. Model formats commonly contain large data files, but trusted custom model implementations may include executable Python modules; treating those modules as trusted expands the server's execution boundary beyond the audited vLLM code. ### Attack Path 1. An attacker supplies a malicious model package or gains write access to `/home/jhernandez/models/nemotron-super-120b-nvfp4`. 2. The attacker adds or alters custom model Python code referenced by the model metadata. 3. The operator starts or restarts vLLM with `--trust-remote-code`. 4. vLLM loads and executes the attacker-controlled model implementation. 5. The payload runs with the vLLM process's permissions and gains access to its files, network connectivity, environment, and GPU workload context. ### Impact Assessment Successful exploitation allows arbitrary Python execution as the vLLM service user. The payload may read or modify local model files, access servic ...[truncated 342 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--trust-remote-code` unless the selected model demonstrably requires custom code. 2. If custom code is required, pin the model to an immutable, reviewed revision. 3. Generate and verify cryptographic hashes for all model metadata and executable Python files before startup. 4. Review custom model code separately from large tensor artifacts. 5. Make the verified model directory read-only to the vLLM service account. 6. Run vLLM as a dedicated unprivileged user in a container or comparable sandbox. 7. Restrict filesystem access, Linux capabilities, outbound networking, and writable directories. 8. Configure service hardening controls such as `NoNewPrivileges`, `ProtectSystem`, `PrivateTmp`, and narrowly scoped `ReadWritePaths` where compatible with the deployment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The vLLM launch command uses --trust-remote-code, which permits execution of model-supplied Python code during model load. In a setup guide, presenting this without a strong warning or justification can lead users to execute unreviewed code from model repositories, potentially resulting in arbitrary code execution on the DGX host.

External Script Fetching

High

• Category: Supply Chain

Content

systemctl --user start litellm
```

Verify: `curl http://localhost:4000/health/liveliness` → `"I'm alive!"`

## 4. Tailscale

• Confidence: 97% confidence
• Finding: The skill installs Tailscale by piping a network-fetched shell script directly into sh. Because this script is intended to set up networking software and is followed by privileged activation steps, compromise of the fetched script could lead to arbitrary code execution and broader host/network exposure.

Chaining Abuse

High

• Category: Tool Misuse

Content

## 4. Tailscale

```bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Visit the auth URL shown, then approve in Tailscale admin
tailscale ip -4  # note this IP for OpenClaw client configs

• Confidence: 96% confidence
• Finding: The explicit command chaining of curl ... | sh is a classic high-risk pattern because it immediately executes unverified remote content in a shell. In this context, it is especially dangerous because the skill is for provisioning an inference server, so compromise can affect models, API keys, and remote access configuration.

Credential Access

High

• Category: Privilege Escalation

Content

Host macmini
    HostName <tailscale-ip>
    User jimmy
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
```
Then ensure `~/.ssh/authorized_keys` exists on the target machine with your public key.

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
```
Then ensure `~/.ssh/authorized_keys` exists on the target machine with your public key.

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

The DGX Spark uses the GB10 Blackwell chip (sm_121). Stock PyPI packages do NOT support sm_121 — everything must be custom built or sourced from specific index URLs.

```bash
mkdir -p ~/vllm-install
cd ~/vllm-install
uv venv .vllm --python 3.12
source .vllm/bin/activate

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF

systemctl --user daemon-reload
systemctl --user enable litellm
systemctl --user start litellm
```

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly installs and enables Tailscale, then instructs the user to use the resulting Tailscale IP for OpenClaw clients, which exposes the LiteLLM service to remote network access. While Tailscale is a legitimate secure-access tool, the guide omits any warning about reducing exposure with ACLs, binding services to localhost, or limiting which users/devices can reach the DGX host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Visit the auth URL shown, then approve in Tailscale admin
tailscale ip -4  # note this IP for OpenClaw client configs
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Script Fetching

Low

• Category: Supply Chain

Content

- DGX Spark with Ubuntu (user: `jhernandez`)
- Model downloaded to `/home/jhernandez/models/nemotron-super-120b-nvfp4`
- Python 3.12 available (`python3 --version`)
- `uv` installed (`curl -LsSf https://astral.sh/uv/install.sh | sh`)

## 1. vLLM Environment Setup

• Confidence: 87% confidence
• Finding: The guide instructs users to install uv by piping a remotely fetched script directly into sh. This pattern bypasses inspection and integrity verification, so if the remote host, transport, or script content is compromised, arbitrary shell commands will execute on the system.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: references/litellm-config-template.yaml:8