vastai
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation instructions and self-update mechanism in
cli/selfupdate.pyandcli/commands/update.pyusecurl | bashto download and execute scripts fromhttps://vast.ai/install.sh. This is a core feature for maintaining the tool and originates from the vendor's official domain. - [EXTERNAL_DOWNLOADS]: The CLI fetches version manifests from
https://vast.ai/cli/manifest.jsonto check for updates and downloads an SSL certificate fromhttps://console.vast.ai/static/jvastai_root.certo secure worker connections. - [COMMAND_EXECUTION]: Multiple modules (e.g.,
cli/display.py,cli/selfupdate.py,serverless/remote/serve_deployment.py) utilizesubprocess.runandsubprocess.Popento manage the local environment, install dependencies viaapt-getoruv, and interface with system utilities likelessandrsync. - [DYNAMIC_EXECUTION]: The serverless framework implementation in
serverless/remote/serialization.pyandserverless/remote/serve.pyusesimportlib.import_moduleandcls.__new__to deserialize objects and route remote function calls. This is restricted to the context of the user's own serverless deployments.
Audit Metadata