skills/vast-ai/vast-cli/vastai/Gen Agent Trust Hub

vastai

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The installation instructions and self-update mechanism in cli/selfupdate.py and cli/commands/update.py use curl | bash to download and execute scripts from https://vast.ai/install.sh. This is a core feature for maintaining the tool and originates from the vendor's official domain.
  • [EXTERNAL_DOWNLOADS]: The CLI fetches version manifests from https://vast.ai/cli/manifest.json to check for updates and downloads an SSL certificate from https://console.vast.ai/static/jvastai_root.cer to secure worker connections.
  • [COMMAND_EXECUTION]: Multiple modules (e.g., cli/display.py, cli/selfupdate.py, serverless/remote/serve_deployment.py) utilize subprocess.run and subprocess.Popen to manage the local environment, install dependencies via apt-get or uv, and interface with system utilities like less and rsync.
  • [DYNAMIC_EXECUTION]: The serverless framework implementation in serverless/remote/serialization.py and serverless/remote/serve.py uses importlib.import_module and cls.__new__ to deserialize objects and route remote function calls. This is restricted to the context of the user's own serverless deployments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 07:14 PM
Security Audit — agent-trust-hub — vastai