Claude Code, Skill
Gpu Perf Tune
GPU performance engineering for agents and MCP clients, with an inference-focused skills package and reusable cluster utilities.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
plugins/profile-and-optimize/server/tools/stage-model-parallel.py, line 66
with socket.create_connection((u.hostname, port), timeout=timeout):
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
plugins/profile-and-optimize/hooks/provenance-audit.py, line 26
result = subprocess.run(
plugins/profile-and-optimize/server/tools/test_hooks.py, line 24
process = subprocess.run(
plugins/profile-and-optimize/server/tools/test_hooks.py, line 123
subprocess.run(["git", "init", "-q", str(repo)], check=True)
Show more
plugins/profile-and-optimize/server/tools/test_hooks.py, line 124
subprocess.run(["git", "-C", str(repo), "add", str(source)], check=True)
plugins/profile-and-optimize/server/tools/test_runtime_scripts.py, line 106
subprocess.run([BASH, str(script)], env=env, check=True)
plugins/profile-and-optimize/server/tools/test_runtime_scripts.py, line 107
subprocess.run([BASH, str(script)], env=env, check=True)
plugins/profile-and-optimize/server/tools/test_runtime_scripts.py, line 111
subprocess.run([BASH, str(script)], env=env, check=True)
plugins/profile-and-optimize/server/tools/test_runtime_scripts.py, line 145
result = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
plugins/profile-and-optimize/server/tools/stage-model-parallel.py, line 66
with socket.create_connection((u.hostname, port), timeout=timeout):
plugins/profile-and-optimize/server/tools/stage-model-parallel.py, line 177
def fetch(key, size, out):
plugins/profile-and-optimize/server/tools/perf_tune_report/orchestrator/production_steps.py, line 21
warmup ``kubectl exec curl /v1/models`` retry up to 60s
Show more
plugins/profile-and-optimize/server/tools/perf_tune_report/runners/settle.py, line 49
" urllib.request.urlopen(r, timeout=600).read()\n"
plugins/profile-and-optimize/server/tools/perf_tune_report/runners/spec_metrics.py, line 54
f"m = urllib.request.urlopen('{base}/metrics', timeout=30).read().decode()\n"
plugins/profile-and-optimize/server/tools/profiling/hang_detector/gpusd_scraper.py, line 23
``curl http://<node>:<port>/metrics > snapshot.json`` and replay it
plugins/profile-and-optimize/skills/inference-decode-step-budget/SKILL.md, line 81
start["curl -XPOST localhost:8000/start_profile"]
plugins/profile-and-optimize/skills/inference-decode-step-budget/SKILL.md, line 83
stop["curl -XPOST localhost:8000/stop_profile"]
plugins/profile-and-optimize/skills/zymtrace-anchored-query/SKILL.md, line 117
if ! curl -fsS -o /dev/null -m 2 'http://localhost:9123/ping'; then
scripts/check-doc-links.sh, line 16
# when curl is missing or --no-network is passed (cluster login nodes
scripts/check-doc-links.sh, line 249
# GitHub orgs whose repos return 404 to unauthenticated curl HEAD requests even
scripts/check-doc-links.sh, line 257
"""Single-URL curl HEAD invocation. Designed to be thread-pool-friendly."""
scripts/check-doc-links.sh, line 279
# Internal repo / blob; unauth curl would return 404. Trust that the
scripts/check-doc-links.sh, line 284
return True, "skipped (curl missing)"
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
plugins/profile-and-optimize/server/tools/stage-model-parallel.py, line 55
AK = os.environ.get("PERFLAKE_LAKE_S3_ACCESS_KEY") or os.environ.get("AWS_ACCESS_KEY_ID")
plugins/profile-and-optimize/server/tools/stage-model-parallel.py, line 56
SK = os.environ.get("PERFLAKE_LAKE_S3_SECRET_KEY") or os.environ.get("AWS_SECRET_ACCESS_KEY")
plugins/profile-and-optimize/server/tools/perf_tune_report/lake_writer.py, line 2122
perflake ``.env``.
Show more
plugins/profile-and-optimize/server/tools/perf_tune_report/lake_writer.py, line 2258
"./.env; set +a`), or pass "
plugins/profile-and-optimize/server/tools/profile_and_optimize_mcp/scripts/configure_clients.py, line 126
f"[mcp_servers.{SERVER_NAME}.env]",
plugins/profile-and-optimize/skills/inference-aa-workload/assets/repro_artificialanalysis.py, line 312
default=os.environ.get("API_KEY", os.environ.get("WANDB_INFERENCE_API_KEY", "")),
plugins/profile-and-optimize/skills/inference-aa-workload/assets/repro_artificialanalysis.py, line 322
p.add_argument("--tokenizer", default=os.environ.get("TOKENIZER", "") or None)
.gitignore, line 9
dist/
.gitignore, line 10
.env
plugins/profile-and-optimize/server/docs/secrets.md, line 9
Keep a non-secret `.env.example`-style template for local variable names, and
plugins/profile-and-optimize/server/docs/secrets.md, line 10
keep the real `.env` untracked and scoped to the current workstation or
plugins/profile-and-optimize/skills/inference-kernel-ncu-profile/SKILL.md, line 197
env (`kubectl get deploy <name> -o jsonpath='{...env...}'`) before assuming a
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
scripts/extract-release-notes.py, line 1
#!/usr/bin/env python3
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 25d74d031732. requests shell access. The manifest names this permission. accepts a host from input, with no fixed list in this file. reads a credential or environment file. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: 25d74d031732e2f76d30a43e44c3434b588f06b3
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.