Loading listing…
Every scan of this listing, newest first.
Every rescan is logged, even when nothing changed.
By vast-ai
A skill has no tools of its own. It’s instructions, plus any scripts in its folder, that your agent loads when a task needs them, so it can do whatever your agent is allowed to do. We scan the whole SKILL.md for instructions that hide what they do, reach for credentials, run downloaded code or send data out.
Every scan of this listing, newest first.
Every rescan is logged, even when nothing changed.
Nothing new reaches your agent until a person has looked at it.
Scanned on every change, and again when our rules improve.
Every scan of this listing, newest first.
Every rescan is logged, even when nothing changed.
Passed
Safe to install in every agent it supports. Runs in your agent, as instructions.
We read the SKILL.md your agent loads, and the listing for d57a6f1. 6 checks, no findings.
Mentions files that hold private keys or cloud tokens. SKILL.md, line 22
… # Verify auth + check balance vastai create ssh-key ~/.ssh/id_ed25519.pub # Register SSH key (do BEFORE create) vastai search offer…
Mentions files that hold private keys or cloud tokens. SKILL.md, line 176
… # List account SSH keys vastai create ssh-key ~/.ssh/id_ed25519.pub # Add SSH key from file (do BEFORE create instance) …
Runs whatever a URL returns, with no chance to read it first. SKILL.md, line 11
… ## Install ```bash # Linux/macOS (recommended, no Python required) curl -fsSL https://vast.ai/install.sh | bash # or via PyPI (Windows, or if you'd rather use pip) pip install vast…
A skill has no tools of its own. It’s instructions, plus any scripts in its folder, that your agent loads when a task needs them, so it can do whatever your agent is allowed to do. We scan the whole SKILL.md for instructions that hide what they do, reach for credentials, run downloaded code or send data out.