vastai-security-basics
Security guidelines for protecting Vast.ai credentials and infrastructure access.
Install
mkdir -p .claude/skills/vastai-security-basics && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/3076" && unzip -o skill.zip -d .claude/skills/vastai-security-basics && rm skill.zipInstalls to .claude/skills/vastai-security-basics
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Apply Vast.ai security best practices for API keys and instance access.Key capabilities
- →Prevent API keys from being committed to git
- →Load API keys from environment variables
- →Generate dedicated SSH key pairs for Vast.ai
- →Securely wipe data before destroying instances
- →Use SSH tunnels for services on instances
- →Encrypt training data before upload
How it works
The skill provides instructions and code examples for managing API keys as environment variables, generating and uploading dedicated SSH keys, and implementing secure data cleanup procedures for Vast.ai instances.
Inputs & outputs
When to use vastai-security-basics
- →Secure Vast.ai API keys
- →Harden SSH access for GPU instances
- →Audit security configurations
About this skill
Vast.ai Renter Security Boundary
Overview
A Vast.ai renter controls credentials and workload configuration but does not own the physical host. Apply least privilege, prefer verified datacenters for sensitive data, encrypt critical material, and assume destroyed local storage is not a substitute for external recovery.
Prerequisites
- Data classification and decision on whether shared marketplace hardware is permitted
- Scoped API-key and dedicated SSH-key owners
- Approved image provenance, secret injection, network exposure, and checkpoint controls
Instructions
Step 1: Constrain the control plane
Create named scoped keys with only needed permission categories and endpoint constraints. Separate human, CI, monitoring, and deployment identities.
Step 2: Establish SSH trust
Register a dedicated public key before creation, protect the private key, resolve the current connection endpoint, and validate host identity according to policy.
Step 3: Verify workload provenance
Use an immutable image digest, scan it, document its entrypoint, and keep registry, model, and storage credentials out of image layers and startup text.
Step 4: Limit host and network exposure
Prefer verified datacenters for sensitive workloads, expose only required ports, and avoid placing secrets or regulated plaintext on untrusted hosts.
Step 5: Protect recoverability
Encrypt critical data, scope storage credentials to a run prefix, and checkpoint externally before stop, expiry, host failure, or destroy.
Step 6: Rotate and close
Revoke temporary keys, remove obsolete SSH keys and environment variables, verify resource destruction, and retain a redacted audit receipt.
Authentication
API keys are password-equivalent and do not expire by default. Environment injection is appropriate for CI, but logs, shell traces, generated curl commands, and debug bundles must remain secret-free.
Tool Discipline
Use Read and Grep to inspect manifests, configuration, provider output, and existing tests before proposing a mutation. Use Write or Edit only for the approved plan, implementation, test, or redacted receipt; do not create, update, destroy, or fund Vast.ai resources without explicit operator approval.
Output
- Threat and data-placement decision
- Credential, SSH, image, host, network, and storage controls
- Positive/negative access tests plus teardown receipt
Return workload class, selected host trust tier, key IDs/scopes, image digest, exposed ports, checkpoint destination, and cleanup outcome.
Examples
A sensitive training canary uses a verified datacenter, immutable image digest, constrained instance key, dedicated SSH key, encrypted dataset, prefix-scoped checkpoint credential, and confirmed credential revocation after teardown.
Error Handling
| Failure | Response |
|---|---|
| Workload is not allowed on shared hardware | Stop before provisioning and choose an approved environment. |
| Image identity is mutable | Pin a digest and repeat security review. |
| Secret appears in a trace or image | Revoke it, scrub artifacts, rebuild the image, and investigate exposure. |
| External checkpoint is missing | Do not destroy until recovery evidence exists, unless incident containment requires it. |
Resources
Prerequisites
Limitations
- →API key can be leaked if committed to git
- →SSH key can be rejected if not uploaded or wrong key is used
- →Data can be left on destroyed instance if cleanup is forgotten
How it compares
This skill offers specific security patterns for Vast.ai's shared hardware environment, including secure cleanup and key management, which differs from generic cloud security advice.
Compared to similar skills
vastai-security-basics side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| vastai-security-basics (this skill) | 3 | 2mo | Review | Intermediate |
| reverse-engineering-tools | 73 | 5mo | No flags | Advanced |
| game-hacking-techniques | 42 | 4mo | No flags | Advanced |
| solidity-security | 15 | 4mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by jeremylongshore
View all by jeremylongshore →You might also like
reverse-engineering-tools
gmh5225
Guide for reverse engineering tools and techniques used in game security research. Use this skill when working with debuggers, disassemblers, memory analysis tools, binary analysis, or decompilers for game security research.
game-hacking-techniques
gmh5225
Guide for game hacking techniques and cheat development. Use this skill when researching memory manipulation, code injection, ESP/aimbot development, overlay rendering, or game exploitation methodologies.
solidity-security
wshobson
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
ghidra
mitsuhiko
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.