scalingo
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: Fetches and executes the official Scalingo CLI installer from
https://cli-dl.scalingo.com/installand the Rust toolchain installer fromhttps://sh.rustup.rs. These are official sources for the tools described. - [CREDENTIALS_UNSAFE]: Documentation provides examples for managing SSL and secrets by reading sensitive file paths such as
key.pemandcert.pem. These operations are inherent to the skill's purpose of PaaS resource management. - [INDIRECT_PROMPT_INJECTION]: The skill processes application manifests (
scalingo.json) and process definitions (Procfile) which can contain untrusted data from the repository. Ingestion points:scalingo.json,Procfile. Capability inventory: Resource management, environment configuration, and shell execution via thescalingoCLI. Sanitization: Not documented. Boundary markers: None provided. - [COMMAND_EXECUTION]: Extensive interaction with the
scalingoCLI, including management of application formation, addons, and execution of interactive shells in one-off containers. - [EXTERNAL_DOWNLOADS]: Retrieves buildpacks and deployment archives from external URLs, including official repositories on GitHub.
Audit Metadata