zeabur-server-rent
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the Zeabur CLI (
npx zeabur@latest) and shell scripts to perform server management operations, including browsing catalogs, renting servers, and monitoring installation progress. - [EXTERNAL_DOWNLOADS]: It downloads and executes the official
zeaburpackage from the NPM registry usingnpxto ensure the latest management tools are available. - [CREDENTIALS_UNSAFE]: The skill contains logic to retrieve the Zeabur API token from the
ZEABUR_API_KEYenvironment variable or the local configuration file at~/.config/zeabur/cli.yaml. It handles these credentials securely by using temporary configuration files with restricted permissions for network requests to prevent exposure in process lists. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from the Zeabur GraphQL API to track the status of OS installations.
- Ingestion points: JSON responses from the official vendor API at
https://api.zeabur.com/graphql(referenced inSKILL.md). - Boundary markers: The skill uses
jqto explicitly parse structured data, avoiding reliance on raw text interpretation. - Capability inventory: The skill uses shell utilities (
curl,jq,grep,awk) to manage the authentication flow and API interactions. - Sanitization: External data is validated against expected status strings (e.g.,
READY,FAILED) and boolean values usingjqbefore proceeding with logic.
Audit Metadata