skills/evolv3-ai/vibe-skills/vultr/Gen Agent Trust Hub

vultr

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the vultr-cli tool directly from the vendor's official GitHub repository during the installation process.
  • [REMOTE_CODE_EXECUTION]: As part of the prerequisite setup, the skill downloads a binary archive and extracts it for execution to enable cloud management capabilities.
  • [COMMAND_EXECUTION]: The skill uses vultr-cli for server provisioning, firewall configuration, and Kubernetes cluster management, alongside ssh for remote server verification.
  • [DATA_EXFILTRATION]: The skill accesses the user's public SSH key for deployment purposes and stores configuration variables, including IP addresses and local key paths, in a .env.local file.
  • [PRIVILEGE_ESCALATION]: The installation instructions utilize sudo to move the vultr-cli binary to a system directory (/usr/local/bin/), which is a standard procedure for installing command-line tools.
  • [DYNAMIC_EXECUTION]: The skill generates local environment configuration scripts at runtime by appending deployment metadata to a local file.
  • [INDIRECT_PROMPT_INJECTION]: The skill interpolates user-supplied parameters into shell commands, representing a potential surface for injection if inputs are not validated by the agent platform.
  • Ingestion points: SERVER_NAME and SSH_KEY_NAME parameters collected in SKILL.md and assets/env-template.
  • Boundary markers: No specific delimiters or safety instructions are used when interpolating these values into commands like grep or vultr-cli instance create.
  • Capability inventory: The skill executes vultr-cli, ssh, curl, and shell processing tools (grep, awk, echo).
  • Sanitization: No sanitization or escaping mechanisms are applied to user-provided strings before they are executed in a shell context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 07:05 PM