Gpu Deploy

PassAudited by ClawScan on May 10, 2026.

Overview

This is a mostly transparent SSH-based vLLM deployment guide, but it can start or stop persistent services on GPU servers and the referenced helper script is not included.

Install only if you intend the agent to manage GPU servers over SSH. Verify any external gpu-deploy script before using it, configure only trusted servers, confirm deploy/stop targets, and avoid misleading served model names.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used on the wrong host or port, the agent could start services on an unintended GPU server.

Why it was flagged

The skill documents remote shell execution over SSH to start a vLLM service, which is expected for deployment but can change remote server state.

Skill content
ssh <user>@<host> "tmux new-session -d -s vllm '... vllm serve ... --port 8111 ...'"
Recommendation

Confirm the target server, model, and port before running deploy or stop commands.

What this means

Commands run with whatever permissions the configured SSH account has on the remote server.

Why it was flagged

The skill relies on the user's SSH access to remote GPU servers; this is purpose-aligned but uses delegated account privileges.

Skill content
ssh <user>@<host> nvidia-smi
Recommendation

Use a least-privileged SSH account and configure only servers you intend the agent to manage.

What this means

If you obtain a gpu-deploy script from somewhere else, that separate code is outside this review and could behave differently from the documentation.

Why it was flagged

The README references a gpu-deploy executable, but the provided package contains only README.md and SKILL.md with no install spec or script to review.

Skill content
cp gpu-deploy ~/.local/bin/
chmod +x ~/.local/bin/gpu-deploy
Recommendation

Review or source the gpu-deploy script from a trusted repository before placing it on PATH.

What this means

Applications calling the service may believe they are using GPT-4o-mini when they are actually using a different local model.

Why it was flagged

The example serves a DeepSeek model under the name gpt-4o-mini, which may be intentional for API compatibility but could mislead downstream users or tools about the actual model.

Skill content
vllm serve ... DeepSeek-R1-Distill-Qwen-32B-AWQ/ ... --served-model-name gpt-4o-mini
Recommendation

Set served_model_name to an accurate or clearly documented alias for the deployed model.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

A deployed service may continue consuming GPU resources after the initiating task ends.

Why it was flagged

The skill intentionally recommends keeping the model service running in the background; this persistence is disclosed and expected for model serving.

Skill content
后台运行 - 建议使用 tmux/screen 保持服务运行
Recommendation

Monitor running services and use the documented stop command or tmux controls when the service is no longer needed.