Skip to content
skillsafebeta
← Report library
Purpose / Other

Airunway Aks Setup Skill Security Audit

What the author says it does (original text)

Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: \"setup AI Runway\", \"onboard AKS cluster\", \"install AI Runway\", \"airunway setup\", \"deploy model to AKS\", \"GPU inference on AKS\", \"KAITO setup on AKS\", \"run LLM on AKS\", \"vLLM on AKS\", \"set up model serving on AK

Independent security check

Security risks found

Files checked
17
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation executes repository Make targets and deploys images without digest pinning

Source references: 8
What we found

The Skill directly runs repository-defined Make targets whose actual commands are not present in the supplied source. Provider images are selected from an `IMG` default without requiring a digest or signature check, although the bundled Azure guidance recommends signed, policy-approved images.

Why this matters

If the repository, Makefile, mutable image tag, or registry is compromised, installation could execute additional commands on the user's machine or run substituted controller code with cluster privileges.

After confirmation, the skill executes repository-defined Make targets whose definitions are absent from the supplied source, so their actual commands cannot be verified here. Provider setup also permits a Makefile default or an `<image>` without requiring an immutable digest or signature verification. If the repository or image source is substituted, unexpected code could be deployed. The user can require expanded targets, an approved registry, digest pinning, and signature enforcement.

references/steps/step-2-controller.md:18In the instructionsOpen original file
```bashmake controller-install   # Install CRDsmake controller-deploy    # Deploy controller manager```
Show 7 other places
references/steps/step-4-provider.md:29In the instructionsOpen original file
First, check the provider's Makefile or README for the default image:```bash# List available providers and their default imagesls providers/cat providers/<provider>/Makefile | grep -E 'IMG\s*\?='```
references/steps/step-4-provider.md:41In the instructionsOpen original file
```bashcd providers/<provider>make deploy IMG=<image>```
azure-kubernetes/SKILL.md:91In the instructionsOpen original file
- Enable **Encryption at rest** for etcd/API server; **in-transit** for node-to-node- Allow only signed, policy-approved images (Azure Policy + Ratify), prefer **Azure Container Registry**- **Isolation**: Use namespaces, network policies, scoped logging
references/steps/step-2-controller.md:15In the instructionsOpen original file
**If not installed:** Ask user to confirm, then from the **repository root** run:```bashmake controller-install   # Install CRDsmake controller-deploy    # Deploy controller manager```
references/steps/step-4-provider.md:27In the instructionsOpen original file
**Installation** — from the **repository root**:First, check the provider's Makefile or README for the default image:```bash# List available providers and their default imagesls providers/cat providers/<provider>/Makefile | grep -E 'IMG\s*\?='```
references/steps/step-4-provider.md:39In the instructionsOpen original file
Then deploy:```bashcd providers/<provider>make deploy IMG=<image>```> **Tip:** If the Makefile defines a default `IMG`, you can omit the `IMG=` argument and just run `make deploy`.
azure-kubernetes/SKILL.md:87In the instructionsOpen original file
### 3. Security- Use **Microsoft Entra ID** everywhere (control plane, Workload Identity for pods, node access). Avoid static credentials.- Azure Key Vault via **Secrets Store CSI Driver** for secrets- Enable **Azure Policy** + **Deployment Safeguards**- Enable **Encryption at rest** for etcd/API server; **in-transit** for node-to-node- Allow only signed, policy-approved images (Azure Policy + Ratify), prefer **Azure Container Registry**- **Isolation**: Use namespaces, network policies, scoped logging
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The PowerShell flow can leave a plaintext HuggingFace token file after failure

Source references: 2
What we found

The PowerShell variant converts the SecureString back to plaintext and writes it to a fixed temporary file. Removal occurs after the kubectl operation and is not protected by a `finally` block covering the full sequence.

Why this matters

If kubectl fails, the terminal closes, or execution is interrupted, `hf-token.txt` may remain in the temporary directory and expose the account token to local users or processes that can read it.

The PowerShell variant converts the SecureString back to plaintext and writes it to the fixed path `$env:TEMP\hf-token.txt`. Cleanup is an ordinary command after kubectl; interruption, kubectl failure, or process termination after the write can leave the file behind, and no file ACL restriction is shown. Other principals able to read that temp location could obtain the token. The user can require a random path, restrictive ACLs, and cleanup in an outer `try/finally`.

references/powershell-notes.md:51In the instructionsOpen original file
```powershell$token = Read-Host -Prompt "HuggingFace token" -AsSecureString$bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($token)try {  [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr) |    Set-Content -NoNewline -Encoding UTF8 -Path "$env:TEMP\hf-token.txt"} finally {  [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)}
Show 1 other places
references/powershell-notes.md:60In the instructionsOpen original file
kubectl create secret generic hf-token `  --from-file=token="$env:TEMP\hf-token.txt" `  -n <namespace> `  --dry-run=client -o yaml | kubectl apply -f -Remove-Item -Force "$env:TEMP\hf-token.txt"```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The fixed `hf-token` name can overwrite an existing Kubernetes Secret

Source references: 2
What we found

The token is written to the fixed name `hf-token` using `kubectl apply`, with no prior check for an existing Secret of that name in the namespace.

Why this matters

Applications relying on an existing same-named Secret may lose their credential and fail authentication. Existing readers of that Secret may also gain access to the newly supplied token.

The flow always builds a Secret named `hf-token` and passes its YAML to `kubectl apply`. It does not first inspect or confirm an existing object with that name; if one exists in the namespace, apply may update its `token` data and affect workloads relying on the prior credential. The user can require a deployment-specific name or an explicit conflict check and overwrite confirmation.

references/steps/step-5-deploy.md:38In the instructionsOpen original file
kubectl create secret generic hf-token \  --from-file=token="$hf_token_file" \  -n <namespace> \  --dry-run=client -o yaml | kubectl apply -f -```
Show 1 other places
references/steps/step-5-deploy.md:60In the instructionsOpen original file
spec:  model:    id: <model-id>    huggingFaceTokenSecretRef:      name: hf-token      key: token  provider:
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

Skipping verification can modify the wrong Kubernetes cluster

Source references: 6
What we found

All write operations target the active kubectl context, while `skip-to-step N` explicitly assumes earlier steps are complete. This can bypass displaying and checking the active cluster before CRDs, controllers, or models are installed.

Why this matters

If the terminal points to another or production cluster, the confirmed operation could create cluster-wide CRDs, controllers, and workloads in the wrong environment.

The skill permits starting at a later step while assuming earlier checks passed, but cluster identity is checked only in Step 1 through the current kubectl context. With `skip-to-step 2` or later, subsequently confirmed installs or deployments would target whichever context is currently active. The user can require an unconditional context, namespace, and cluster-identity confirmation immediately before every write.

SKILL.md:50In the instructionsOpen original file
4. If a step is already complete, report status and skip to the next step5. If the user provides `skip-to-step N`, start at step N; assume prior steps are complete
Show 5 other places
references/steps/step-1-verify.md:23In the instructionsOpen original file
```bash# Confirm active contextkubectl config current-context# Inventory all nodeskubectl get nodes -o wide```
references/steps/step-2-controller.md:18In the instructionsOpen original file
```bashmake controller-install   # Install CRDsmake controller-deploy    # Deploy controller manager```
SKILL.md:48In the instructionsOpen original file
2. Report cluster state at each step: ✓ healthy, ✗ missing/failed3. Ask for user confirmation before any install or deployment action4. If a step is already complete, report status and skip to the next step5. If the user provides `skip-to-step N`, start at step N; assume prior steps are complete
references/steps/step-1-verify.md:22In the instructionsOpen original file
```bash# Confirm active contextkubectl config current-context# Inventory all nodeskubectl get nodes -o wide```
references/steps/step-2-controller.md:15In the instructionsOpen original file
**If not installed:** Ask user to confirm, then from the **repository root** run:```bashmake controller-install   # Install CRDsmake controller-deploy    # Deploy controller manager```
Medium risk

The autoscaler tuning permits eviction of system pods

Source references: 5
What we found

The bundled AKS guidance sets `skip-nodes-with-system-pods=false`, explicitly allowing the Cluster Autoscaler to scale down nodes containing system pods. It warns about PDBs, but the command does not verify that every system workload has effective PDB protection.

Why this matters

With missing or ineffective PDBs or insufficient replicas, scale-down can interrupt DNS, networking, monitoring, or other cluster services and affect every application in the cluster.

This is scenario-specific tuning guidance with an explicit warning and confirmation requirement, not unconditional behavior. Nevertheless, its command sets `skip-nodes-with-system-pods=false`. If applied while system pods lack effective PDBs, scale-down may evict them and disrupt cluster services. The document only lists a PDB inspection command; it does not enforce complete coverage. The user can keep the default or require validation of replicas and PDBs for every critical system workload first.

azure-kubernetes/references/azure-aks-autoscaler.md:51In the instructionsOpen original file
Apply when CAS is already on but idle nodes persist:> ⚠️ **Warning:** Setting `skip-nodes-with-system-pods=false` allows CAS to evict system pods. Ensure all system pods in `kube-system` have PodDisruptionBudgets before enabling this.```bashaz aks update \  --name "<CLUSTER_NAME>" --resource-group "<RESOURCE_GROUP>" \  --cluster-autoscaler-profile \    scale-down-delay-after-add=10m \    scale-down-unneeded-time=10m \    scale-down-utilization-threshold=0.5 \    max-graceful-termination-sec=600 \    skip-nodes-with-system-pods=false```
Show 4 other places
azure-kubernetes/references/azure-aks-autoscaler.md:85In the instructionsOpen original file
>> Check existing PDBs before tuning:> ```bash> kubectl get pdb --all-namespaces> ```
azure-kubernetes/references/azure-aks-autoscaler.md:49In the instructionsOpen original file
## Tune CAS ProfileApply when CAS is already on but idle nodes persist:> ⚠️ **Warning:** Setting `skip-nodes-with-system-pods=false` allows CAS to evict system pods. Ensure all system pods in `kube-system` have PodDisruptionBudgets before enabling this.
azure-kubernetes/references/azure-aks-autoscaler.md:55In the instructionsOpen original file
```bashaz aks update \  --name "<CLUSTER_NAME>" --resource-group "<RESOURCE_GROUP>" \  --cluster-autoscaler-profile \    scale-down-delay-after-add=10m \    scale-down-unneeded-time=10m \    scale-down-utilization-threshold=0.5 \    max-graceful-termination-sec=600 \    skip-nodes-with-system-pods=false```
azure-kubernetes/references/azure-aks-autoscaler.md:83In the instructionsOpen original file
> Risk: High for aggressive tuning. Ensure PodDisruptionBudgets (PDBs) are set on critical workloads before tuning. Always confirm with user before applying.>> Check existing PDBs before tuning:> ```bash> kubectl get pdb --all-namespaces> ```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

The Skill normally reads the active kubectl context, inventories nodes and GPUs, and then asks for confirmation before installing the controller, inference provider, and model resources. However, `skip-to-step N` assumes all earlier checks are complete.

View source
SKILL.md:46In the instructionsOpen original file
1. Execute steps in sequence — load the reference for each step as you reach it2. Report cluster state at each step: ✓ healthy, ✗ missing/failed3. Ask for user confirmation before any install or deployment action4. If a step is already complete, report status and skip to the next step5. If the user provides `skip-to-step N`, start at step N; assume prior steps are complete
references/steps/step-1-verify.md:22In the instructionsOpen original file
```bash# Confirm active contextkubectl config current-context# Inventory all nodeskubectl get nodes -o wide```

Installation runs Make targets from the repository and deploys the controller and selected provider into the current Kubernetes cluster. The provider image comes from its Makefile default or a caller-supplied `IMG` value.

View source
references/steps/step-2-controller.md:15In the instructionsOpen original file
**If not installed:** Ask user to confirm, then from the **repository root** run:```bashmake controller-install   # Install CRDsmake controller-deploy    # Deploy controller manager```
references/steps/step-4-provider.md:39In the instructionsOpen original file
Then deploy:```bashcd providers/<provider>make deploy IMG=<image>```

For gated HuggingFace models, the Skill collects an access token, creates a Kubernetes Secret named `hf-token`, and references it from the ModelDeployment. Any cluster principal with permission to read that Secret can obtain the credential.

View source
references/steps/step-5-deploy.md:38In the instructionsOpen original file
kubectl create secret generic hf-token \  --from-file=token="$hf_token_file" \  -n <namespace> \  --dry-run=client -o yaml | kubectl apply -f -```
references/steps/step-5-deploy.md:60In the instructionsOpen original file
spec:  model:    id: <model-id>    huggingFaceTokenSecretRef:      name: hf-token      key: token  provider:

If no cluster exists, the main Skill hands off to the bundled `azure-kubernetes` Skill, which also contains operations that can alter autoscaling, create Spot node pools, and change workload resources, affecting cost or availability.

View source
SKILL.md:19In the instructionsOpen original file
This skill assumes an AKS cluster already exists. If the user does not have a cluster, hand off to the `azure-kubernetes` skill first to provision one (with a GPU node pool unless CPU-only inference is acceptable), then return here.
azure-kubernetes/SKILL.md:125In the instructionsOpen original file
### 9. Cost Controls- Use **Spot node pools** for batch/interruptible workloads (up to 90% savings)- **Stop/Start** dev/test clusters: `az aks stop/start`- Consider **Reserved Instances** or **Savings Plans** for steady-state workloads
Start here · InstructionsSKILL.md
airunway-aks-setup
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 23
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records17 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/steps/step-1-verify.mdFull text included
  • references/steps/step-2-controller.mdFull text included
  • references/steps/step-3-gpu.mdFull text included
  • references/steps/step-4-provider.mdFull text included
  • references/steps/step-5-deploy.mdFull text included
  • references/steps/step-6-summary.mdFull text included
  • references/troubleshooting.mdFull text included
  • azure-kubernetes/references/azure-aks-autoscaler.mdFull text included
  • azure-kubernetes/references/azure-aks-rightsizing.mdFull text included
  • azure-kubernetes/references/azure-aks-spot.mdFull text included
  • azure-kubernetes/references/azure-aks-vpa.mdFull text included
  • azure-kubernetes/references/cli-reference.mdFull text included
  • references/gpu-profiles.mdFull text included
  • references/model-sizing.mdFull text included
  • references/powershell-notes.mdFull text included
  • azure-kubernetes/SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/gpu-profiles.mdSupporting file
  • references/model-sizing.mdSupporting file
  • references/powershell-notes.mdSupporting file
  • references/steps/step-1-verify.mdSupporting file
  • references/steps/step-2-controller.mdSupporting file
  • references/steps/step-3-gpu.mdSupporting file
  • references/steps/step-4-provider.mdSupporting file
  • references/steps/step-5-deploy.mdSupporting file
  • references/steps/step-6-summary.mdSupporting file
  • references/troubleshooting.mdSupporting file
  • azure-kubernetes/SKILL.mdSupporting file
  • azure-kubernetes/references/cli-reference.mdSupporting file
  • azure-kubernetes/references/azure-aks-rightsizing.mdSupporting file
  • azure-kubernetes/references/azure-aks-vpa.mdSupporting file
  • azure-kubernetes/references/azure-aks-autoscaler.mdSupporting file
  • azure-kubernetes/references/azure-aks-spot.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:26In the instructionsOpen original file
| Best for | End-to-end AI Runway onboarding on AKS || CLI tools | `kubectl`, `make`, `curl` || MCP tools | None |
references/powershell-notes.md:8In the instructionsOpen original file
```powershell@('kubectl', 'make', 'curl') | ForEach-Object {  if (Get-Command $_ -ErrorAction SilentlyContinue) {
references/steps/step-1-verify.md:11In the instructionsOpen original file
# Check all required tools are installedfor tool in kubectl make curl; do  command -v "$tool" >/dev/null 2>&1 && echo "✓ $tool found" || echo "✗ $tool NOT FOUND — install before continuing"
Read keys or account settings
SKILL.md:67In the instructionsOpen original file
|-----------------|--------------|-------------|| No kubeconfig context | Not connected to a cluster | Run `az aks get-credentials` or equivalent || Controller in CrashLoopBackOff | Config or RBAC issue | `kubectl logs -n airunway-system -l control-plane=controller-manager --previous` |
references/steps/step-1-verify.md:52In the instructionsOpen original file
**Decision logic:**- No kubeconfig context → **STOP**. Tell user to configure `kubeconfig` (e.g., `az aks get-credentials`) and retry.- No GPU nodes detected → Note "CPU-only cluster" and proceed; CPU-only inference is available via KAITO + llama.cpp.
references/troubleshooting.md:7In the instructionsOpen original file
|-----------------|--------------|-------------|| No kubeconfig context | Not connected to a cluster | Run `az aks get-credentials` or equivalent || `make: *** No rule to make target` | Not in AI Runway repo root | `cd` to repo root and retry |
Run commands
references/powershell-notes.md:1In the instructionsOpen original file
# PowerShell Command Variants
references/powershell-notes.md:3In the instructionsOpen original file
This reference provides PowerShell equivalents for commands in steps 1, 4, 5, and 6 that use Bash-specific syntax.
references/powershell-notes.md:7In the instructionsOpen original file
```powershell@('kubectl', 'make', 'curl') | ForEach-Object {
Read files
references/steps/step-4-provider.md:34In the instructionsOpen original file
ls providers/cat providers/<provider>/Makefile | grep -E 'IMG\s*\?='```
Change files
references/steps/step-5-deploy.md:30In the instructionsOpen original file
hf_token_file="$(mktemp)"trap 'rm -f "$hf_token_file"' EXIT
Lines read
1,175
File checksum (to compare versions)
9cefbc995287f9ed1e76bc4b77b14d9438d93c140b2a19b895187dcbc931d4b8