vastai

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to solicit and then embed API keys/tokens directly into CLI commands (e.g., "vastai set api-key <YOUR_API_KEY>", "vastai create env-var HF_TOKEN ", exporting VAST_API_KEY), which requires the LLM to handle and emit secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documents Vast.ai CLI commands that explicitly move account credit or deposit funds: e.g. "vastai prepay instance 100", "vastai transfer credit --recipient EMAIL --amount 10", and "vastai create team ... --transfer-credit 50". These are explicit transaction operations that change account balances / transfer funds, so the skill grants direct financial execution capability.