vastai-observability
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the
vastai show instances --rawcommand, which contains metadata and labels that could be controlled by an external party or a shared account holder. - Ingestion points: The Python
VastMetricsCollectorscript inSKILL.md(Step 1) parses JSON output from the externalvastaiCLI tool. - Boundary markers: The skill lacks explicit delimiters or instructions for the agent to distinguish between valid instance data and potential malicious instructions embedded within that data.
- Capability inventory: The skill utilizes
subprocess.runand provides bash examples for SSH execution, which could be leveraged if the agent is manipulated by injected content. - Sanitization: While the collector uses standard JSON parsing, the example SSH command in Step 3 interpolates variables (
$PORT,$HOST) without sanitization or validation logic. - [COMMAND_EXECUTION]: The skill relies on the execution of external CLI tools and SSH commands. The use of
subprocess.runwith list-based arguments is a standard practice, but the inclusion of shell-based SSH commands in Step 3 presents a capability that could be misused if provided with untrusted input.
Audit Metadata