Security audit

Zeabur Deployment

Security checks for vulnerabilities and agentic risk

Overview

This deployment skill uses account access and application secrets for its stated purpose, with clear limits on changes, spending, and data handling.

Confirm the target account, services, and budget before deployment. Prefer a reviewed, fixed CLI version, and review uploaded files, secret handling, and migration rollback plans before production changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 60% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
- Missing configuration: repair the intended service's configuration and restart when required; do not weaken fail-closed checks to get a green deployment. - TLS provisioning: check status with backoff. Do not bypass a certificate warning, add `curl -k`, disable certificate validation or weaken mobile ATS settings. - Failed update: inspect scoped build/runtime logs and preserve data. Use a known previous deployment/image only when schema-compatible. Rollback is not database deletion; backup/approval is needed before an irreversible schema operation.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/cli-operations.md (reported line 87)May include surrounding context.
md
## Variables, networking and diagnostics `variable env --help` says **overwrite variables from a .env file**. Before an update, privately preserve the current environment and merge only intended changes. Do not apply a minimal example file that drops unrelated required vars. The command's output may contain the values: redirect stdout and stderr to a

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The recommended fallback executes zeabur@latest rather than the exact CLI release reportedly checked. Although this is a CLI rather than an MCP server, a compromised future package could execute with the agent's filesystem and credential access; preferring an existing binary reduces but does not eliminate exposure.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This explanatory reference reinforces the floating @latest command prefix used throughout the examples. It is another occurrence of the same supply-chain weakness, not a separate MCP server or evidence of malicious intent.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Even the version check invokes a floating npm package before its version can be inspected. A malicious release could execute locally despite the apparently informational subcommand.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Workspace discovery executes zeabur@latest with access to the local execution environment. Private output redirection protects captured results but cannot prevent a compromised CLI from accessing credentials or sending data elsewhere.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Project listing uses a mutable package version in an authenticated deployment workflow. A compromised release could access credentials or project information independently of the requested read-only operation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Server discovery executes whichever release the latest tag resolves to rather than a reviewed artifact. The read-only command and protected output file do not constrain the executable's actual behavior.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Requesting help still executes the floating npm package locally. A malicious package need not honor the help-only intent and could access available files and credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The deployment help command executes an unpinned package before any help can be inspected. This creates the same conditional supply-chain exposure as the operational commands, even without a requested mutation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Project creation uses a floating CLI release in a workflow with infrastructure mutation permissions. A compromised release could misuse those permissions, while an unexpected legitimate update could change behavior from the checked version.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Template deployment invokes @latest while processing a template that may contain rendered database credentials. A compromised CLI could access those credentials or perform unauthorized infrastructure operations despite the document's template-review safeguards.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Initial source deployment executes a mutable package from the application's source directory. A compromised release could read source files and available secrets or alter the deployment beyond the approved creation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The update command scopes the intended service correctly but still runs an unpinned executable. A compromised CLI could ignore that scope, access source code, or misuse the deployment credentials.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The floating CLI is explicitly given an environment file that may contain application secrets. Private output capture does not prevent a compromised executable from reading or exfiltrating that file.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Runtime restart executes an unpinned CLI with authenticated service access. A compromised release could perform actions beyond restarting the specified service, regardless of the command's explicit identifiers.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Domain listing uses a floating executable within an authenticated deployment environment. Although the intended operation is read-only, a compromised package could access credentials or perform other actions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Domain creation relies on a mutable CLI package while exercising infrastructure mutation permissions. The explicit endpoint-approval condition is useful but cannot constrain a compromised executable.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Deployment metadata retrieval still executes zeabur@latest locally. A compromised release could misuse available credentials even though the intended operation only reads deployment state.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Log retrieval executes a floating package and may process sensitive runtime output. Protected local storage mitigates accidental disclosure but not exfiltration by a compromised CLI.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --yes zeabur'.

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Database network inspection invokes an unpinned executable with access to platform credentials and network metadata. The private-networking checks are beneficial, but they do not address package supply-chain compromise.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/go-mysql.md (reported line 65)May include surrounding context.
md
A smoke script should clean up its own disposable fixtures and revoke its test session; review its failure/cleanup paths before running it. Do not assume a `finally` block guarantees server-side cleanup without checking what it does. ## Recover using evidence

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE (reported line 5)May include surrounding context.
text
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

No suspicious patterns detected.