zeabur-server-rent

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the Zeabur CLI (npx zeabur@latest) and shell scripts to perform server management operations, including browsing catalogs, renting servers, and monitoring installation progress.
  • [EXTERNAL_DOWNLOADS]: It downloads and executes the official zeabur package from the NPM registry using npx to ensure the latest management tools are available.
  • [CREDENTIALS_UNSAFE]: The skill contains logic to retrieve the Zeabur API token from the ZEABUR_API_KEY environment variable or the local configuration file at ~/.config/zeabur/cli.yaml. It handles these credentials securely by using temporary configuration files with restricted permissions for network requests to prevent exposure in process lists.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from the Zeabur GraphQL API to track the status of OS installations.
  • Ingestion points: JSON responses from the official vendor API at https://api.zeabur.com/graphql (referenced in SKILL.md).
  • Boundary markers: The skill uses jq to explicitly parse structured data, avoiding reliance on raw text interpretation.
  • Capability inventory: The skill uses shell utilities (curl, jq, grep, awk) to manage the authentication flow and API interactions.
  • Sanitization: External data is validated against expected status strings (e.g., READY, FAILED) and boolean values using jq before proceeding with logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 04:29 PM