zeabur-cluster-scale

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [CREDENTIALS_UNSAFE]: Accesses the vendor's CLI configuration file at ~/.config/zeabur/cli.yaml to retrieve authentication tokens. The skill utilizes a security-conscious pattern by writing the token to a temporary file with restricted filesystem permissions (0600) and using the curl -K flag to prevent sensitive headers from appearing in the system process list.
  • [COMMAND_EXECUTION]: Uses shell commands to manage temporary configuration files and perform API requests. This includes the use of mktemp, chmod, and curl for interacting with the Zeabur GraphQL API.
  • [REMOTE_CODE_EXECUTION]: Executes the vendor's official CLI tool using npx zeabur@latest. This is a standard operation for managing vendor resources via their public package registry.
  • [EXTERNAL_DOWNLOADS]: Fetches cluster data and provider-specific instance types from api.zeabur.com and api.linode.com. These are official endpoints for the vendor and a well-known infrastructure service.
  • [SAFE]: The skill documentation emphasizes a mandatory confirmation flow, requiring the agent to present specific billing impacts and cluster details to the user for explicit approval before any destructive or cost-altering changes are executed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 12:09 PM
Security Audit — agent-trust-hub — zeabur-cluster-scale