skills/evolv3-ai/vibe-skills/contabo/Gen Agent Trust Hub

contabo

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to install the cntb CLI, configure authentication, and manage VPS instances. These operations are necessary for the skill's primary purpose of infrastructure automation.
  • [EXTERNAL_DOWNLOADS]: Fetches the official cntb CLI binary from Contabo's GitHub repository (github.com/contabo/cntb). As Contabo is a well-known cloud service provider, this download is treated as a routine integration step.
  • [PRIVILEGE_ESCALATION]: The installation instructions for Linux and macOS use sudo to move the downloaded binary into /usr/local/bin/. While this involves elevated permissions, it is a standard procedure for installing command-line tools system-wide.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-defined parameters that are subsequently interpolated into shell scripts and jq filters, creating a potential surface for command injection if the inputs are not properly sanitized by the executing environment.
  • Ingestion points: Variables such as SERVER_NAME and CONTABO_REGION provided in the SKILL.md setup step.
  • Boundary markers: None; variables are interpolated directly into shell strings.
  • Capability inventory: The skill uses curl, tar, mv, ssh, and the cntb CLI, providing significant system and network access.
  • Sanitization: No explicit validation or escaping of user input is implemented within the skill scripts before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 07:04 PM