Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for deploying vLLM on GPU servers, with expected but potentially impactful remote deployment commands users should run carefully.
Install only if you understand and control the GPU hosts you configure. Before deploying, confirm the SSH target, port, model path, firewall exposure, and whether stopping or starting services could disrupt other workloads.
This markdown file advertises 'one-click' deployment to GPU servers and provides a direct gpu-deploy deploy command, but it does not warn users that deployment may start services, modify remote system state, open ports, or otherwise affect infrastructure. For a deployment-oriented skill, users should be told about the operational impact before running the command.
The skill instructs users to deploy, list, and stop remote model services over SSH, which can change the state of another machine and affect running workloads, but it does not clearly warn that these operations execute on remote servers and may disrupt existing services or expose network endpoints. In a deployment skill this behavior is expected, but the missing safety notice increases the chance of unintended operational impact, especially when a default server is configured and commands are easy to run.
The manual section provides copy-pasteable SSH commands that launch a detached tmux session and start a vLLM service on a remote host, yet it does not warn that this will execute remotely, persist in the background, and potentially expose an inference service on a network port. This is especially risky because the command is ready-made and may be reused without understanding authentication context, firewall exposure, or collision with existing processes.
The skill documentation is written entirely in Chinese, while the heading and repository context do not state that the skill is intentionally China/Chinese-language specific or provide an alternative language option. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Natural-language policy requires avoiding forced language or locale constraints unless users are given a choice or the restriction is justified. This file presents all user-facing documentation in Chinese only, with no opt-in or explanation that the skill is intended solely for a Chinese-speaking audience.
No suspicious patterns detected.
