ClawHub
Back to skill

Security audit

Vast Ai

Security checks across malware telemetry and agentic risk

Overview

This is a coherent VAST.ai GPU rental skill, but users should treat rentals as real paid cloud actions and protect the API key carefully.

Install only if you intend to let an agent use your VAST.ai account. Before approving any rent action, confirm the offer ID, hourly price, image, expected runtime, and how you will stop or destroy the instance to avoid ongoing billing. Keep VAST_API_KEY in a secure secret or environment mechanism, avoid DEBUG logs around failures, and prefer pinned, updated dependencies for production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README explicitly documents a command that rents GPU instances, which can immediately incur real-world charges and allocate billable infrastructure. In an agent-skill context, exposing this as a routine command without prominent warnings, confirmation requirements, budget safeguards, or discussion of irreversible side effects increases the risk of accidental or automated spend.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs use of a user-provided VAST API key via the VAST_API_KEY environment variable while invoking a local CLI, but it provides no warning or handling guidance for protecting that secret. This creates a real risk of accidental disclosure through shell history, process inspection, logs, crash output, or insecure wrapper implementations, especially because the skill explicitly asks the agent to collect and then use the credential for write-capable operations.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill directly consumes a sensitive credential via context.API_KEY to initialize a client that can search, rent, and inspect GPU instances, but this file shows no user-facing disclosure, consent boundary, or restriction on when those billable/provider-affecting actions may occur. In an agent setting, silent use of cloud/service credentials is risky because a downstream prompt or tool invocation could trigger real account actions and spending without the operator clearly understanding that their VAST.ai account is being used.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "axios": "^1.13.4",
    "limiter": "^3.0.0",
    "minimist": "^1.2.8"
  },
Confidence
88% confidence
Finding
"axios": "^1.13.4"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "commonjs",
  "dependencies": {
    "axios": "^1.13.4",
    "limiter": "^3.0.0",
    "minimist": "^1.2.8"
  },
  "devDependencies": {
Confidence
87% confidence
Finding
"limiter": "^3.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "axios": "^1.13.4",
    "limiter": "^3.0.0",
    "minimist": "^1.2.8"
  },
  "devDependencies": {
    "@types/minimist": "^1.2.5",
Confidence
90% confidence
Finding
"minimist": "^1.2.8"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"minimist": "^1.2.8"
  },
  "devDependencies": {
    "@types/minimist": "^1.2.5",
    "@types/node": "^25.2.0",
    "typescript": "^5.9.3"
  }
Confidence
82% confidence
Finding
"@types/minimist": "^1.2.5"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "devDependencies": {
    "@types/minimist": "^1.2.5",
    "@types/node": "^25.2.0",
    "typescript": "^5.9.3"
  }
}
Confidence
82% confidence
Finding
"@types/node": "^25.2.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"devDependencies": {
    "@types/minimist": "^1.2.5",
    "@types/node": "^25.2.0",
    "typescript": "^5.9.3"
  }
}
Confidence
83% confidence
Finding
"typescript": "^5.9.3"

Known Vulnerable Dependency: axios==1.13.4 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
axios==1.13.4

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.