← Back to Skills Marketplace
1380
Downloads
1
Stars
3
Active Installs
1
Versions
Install in OpenClaw
/install vast-ai
Description
Provision and manage on-demand GPUs on VAST.ai, including search by GPU and price, renting containers, retrieving SSH, and checking account balance.
Usage Guidance
What to consider before installing/use: 1) The skill legitimately targets VAST.ai and only needs your VAST API key to operate, which is proportional. 2) The package metadata omits the required VAST_API_KEY — the SKILL.md and code do require it; treat that omission as a red flag and ask the author to correct the metadata. 3) SKILL.md references an absolute developer path (/Users/sschepis/Development/...) and assumes a built dist/cli.js exists; the repo only contains TypeScript sources. You will need to run npm install and build (npx tsc) before the CLI will work — building/installation runs third-party code, so review compiled JS before executing and consider running in an isolated environment. 4) Before providing your VAST API key, verify the network endpoints in the code (baseUrl is console.vast.ai/api/v0) and ensure there are no hidden/external endpoints; this code appears to use only axios to the VAST API. 5) Because the skill can perform write actions (rent, destroy), only supply a key with least privilege (if VAST supports restricted keys) or use an account with limited funds. 6) Ask the publisher to: (a) declare VAST_API_KEY in the skill metadata, (b) remove absolute local paths from SKILL.md and use relative or packaged dist paths, and (c) include built artifacts or an install script so the agent/runtime behaviour is reproducible. If you cannot verify these fixes, run the code in an ephemeral VM/container and avoid giving your production VAST API key.
Capability Analysis
Type: OpenClaw Skill
Name: vast-ai
Version: 1.0.0
The skill bundle is benign. The `SKILL.md` instructions are clear, task-oriented, and fully aligned with the stated purpose of managing VAST.ai GPU rentals, showing no signs of prompt injection. The TypeScript code (`src/*.ts`) implements a client for the legitimate VAST.ai API (`https://console.vast.ai/api/v0`), using standard libraries (`axios`, `limiter`, `minimist`) and handling API keys securely via environment variables. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The absolute path in `SKILL.md` for execution is likely a developer's local path and not indicative of malicious intent.
Capability Assessment
Purpose & Capability
The repository code and SKILL.md implement a VAST.ai client (search, rent, connect, balance) which matches the skill name. However the skill registry metadata claims no required environment variables while the runtime requires a VAST API key (VAST_API_KEY). That mismatch is unexpected and incoherent with the advertised metadata.
Instruction Scope
SKILL.md instructs the agent to run a CLI at an absolute developer path (node /Users/sschepis/Development/vast-ai/dist/cli.js) which will not exist in a runtime/agent environment. The instructions otherwise are scoped to VAST actions and ask the user for an API key before write operations, which is appropriate, but the absolute path and the assumption that a built dist exists are problematic.
Install Mechanism
There is no install spec (instruction-only), but full TypeScript sources, package.json and package-lock.json are included. Running this requires npm install + build (npx tsc) to create dist/*. No external download URLs or shorteners are used; dependencies are standard npm packages (axios, limiter, minimist). The lack of an install step in the skill metadata combined with source-only content is a usability/security concern (you must build/install to run).
Credentials
Runtime requires a single VAST API key (VAST_API_KEY / context.API_KEY) which is proportional to the stated purpose. However the registry metadata lists no required environment variables or primary credential, and SKILL.md/CLI both require VAST_API_KEY. This omission is a significant inconsistency and could lead to accidental exposure or misconfiguration.
Persistence & Privilege
The skill does not request permanent 'always' presence, does not modify other skills or system-wide settings, and does not declare elevated privileges. Autonomous invocation is enabled (default) which is normal and not a standalone concern.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vast-ai - After installation, invoke the skill by name or use
/vast-ai - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of the VAST.ai GPU Rental skill.
- Provision on-demand GPU infrastructure via VAST.ai.
- Search for machines by GPU type and price.
- Rent containers on selected offers.
- Retrieve SSH connection info for active containers.
- Check account credit balance and hourly burn rate.
- Implements step-by-step workflow, including pre-flight balance checks and user warnings for low credit.
Metadata
Frequently Asked Questions
What is Vast Ai?
Provision and manage on-demand GPUs on VAST.ai, including search by GPU and price, renting containers, retrieving SSH, and checking account balance. It is an AI Agent Skill for Claude Code / OpenClaw, with 1380 downloads so far.
How do I install Vast Ai?
Run "/install vast-ai" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Vast Ai free?
Yes, Vast Ai is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Vast Ai support?
Vast Ai is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Vast Ai?
It is built and maintained by sschepis (@sschepis); the current version is v1.0.0.
More Skills